{"id":"CVE-2026-87404","kind":"vulnerability","aliases":["CVE-2026-87404"],"related":[],"title":"Oracle E-Business Suite Pasta printing engine flaw allows takeover over HTTP","description":"Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle's Pasta component, part of E-Business Suite Printing Engine, has a flaw that a low-privileged attacker on the network can reach over HTTP. Successful exploitation can lead to full takeover of the Pasta component with high confidentiality, integrity and availability impact.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","self-hosted","vendor"],"not_affected_if":["unaffected-version"],"how_to_check":"- Confirm the E-Business Suite release in use: unknown if sources list the exact patch level beyond the affected range `12.2.3` to `12.2.15`\n- Check whether the Printing Engine (Pasta) component is deployed in your environment: unknown","fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-87404 for E-Business Suite 12.2: unknown version from the sources\n- Move to a supported E-Business Suite 12.2 release outside the affected range `12.2.3` to `12.2.15`: unknown exact target","status":"open","published_at":"2026-10-20T22:20:18+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:18:43+00:00","updated_at":"2026-10-25T03:18:43+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:18:43Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses CVE-2026-87404 for E-Business Suite 12.2: unknown version from the sources\n- Move to a supported E-Business Suite 12.2 release outside the affected range `12.2.3` to `12.2.15`: unknown exact target","reach":"internet","title":"Oracle E-Business Suite Pasta printing engine flaw allows takeover over HTTP","impact":"high","summary":"Oracle's Pasta component, part of E-Business Suite Printing Engine, has a flaw that a low-privileged attacker on the network can reach over HTTP. Successful exploitation can lead to full takeover of the Pasta component with high confidentiality, integrity and availability impact.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","erp","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the Pasta component with full data access","analyst_note":"Check Oracle's Critical Patch Update advisory for the patch name and exact fixed release, and whether the Printing Engine is exposed over HTTP by default.","how_to_check":"- Confirm the E-Business Suite release in use: unknown if sources list the exact patch level beyond the affected range `12.2.3` to `12.2.15`\n- Check whether the Printing Engine (Pasta) component is deployed in your environment: unknown","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2 releases in the range 12.2.3 to 12.2.15 that use the Printing Engine (Pasta) component are affected. The sources do not say which configurations expose the HTTP path, so systems outside that version range or without Pasta deployed can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":3431,"output_tokens":669,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87404':16A,19A '/av':137C '12.2.15':95C '12.2.3':94C '3.1':124C,136C '7.5':127C 'access':106C 'affect':92C 'allow':10A,100C 'attack':48B,103C,113C 'avail':72B,131C 'base':125C 'busi':4A,36B,83C 'compon':31B,66B,85C 'compromis':110C 'confidenti':69B,128C 'cve':14A,17A 'cvss':123C,133C,135C 'difficult':96C 'e':3A,35B,82C 'e-busi':2A,34B,81C 'eb':23B 'engin':8A,39B,87C 'erp':20B 'exploit':57B,98C 'flaw':9A,42B 'full':61B 'h':145C 'h/a':144C 'h/i':143C 'h/pr':139C 'high':68B 'host':26B 'http':13A,55B,108C 'impact':73B,132C 'integr':70B,129C 'l/ui':140C 'lead':59B 'low':46B,101C 'low-privileg':45B 'n/ac':138C 'n/s':141C 'network':51B,105C 'oracl':1A,22B,28B,80C 'oracle-eb':21B 'part':32B 'pasta':6A,30B,65B,77C,111C,122C 'print':7A,38B,86C 'privileg':47B,102C 'product':78C 'reach':53B 'result':118C 'score':126C 'self':25B 'self-host':24B 'success':56B,112C 'suit':5A,37B,84C 'support':88C 'takeov':11A,62B,120C 'u/c':142C 'vector':134C 'vendor':27B 'version':89C 'via':107C 'vulner':74C,99C,116C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2 releases in the range 12.2.3 to 12.2.15 that use the Printing Engine (Pasta) component are affected. The sources do not say which configurations expose the HTTP path, so systems outside that version range or without Pasta deployed can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87404","severity":null,"published_at":"2026-10-20T22:20:18+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}