Oracle E-Business Suite CVE-2026-87335

Exploitation requires a valid low-privileged Oracle E-Business Suite account with HTTP/network access to the Applications DBA (Internal Operations) component on an affected release (12.2.3 through 12.2.15); no user interaction and no elevated privileges beyond that initial authenticated foothold are needed. The limiting factor is the authentication requirement (PR:L) - this is not an unauthenticated bypass despite the 'Authentication Bypass' tag - which confines realistic attackers to internal users, authorized tenants, or holders of compromised low-privilege credentials. Impact is limited to confidentiality (read access); no data modification or service disruption results.

This is a medium-severity (CVSS 3.1 base 6.5) confidentiality-only flaw in Oracle E-Business Suite's Applications DBA component, disclosed by Oracle in the October 2026 Critical Patch Update. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable, low-complexity attack that requires a low-privileged (authenticated) account, grants no integrity or availability impact, and does not cross a privilege/scope boundary - it yields read access to all data accessible to Applications DBA. Oracle labels it 'easily exploitable,' which aligns with AC:L and no required user interaction, so a holder of any valid low-privilege EBS session is the realistic threat. Countervailing signals keep this below top-priority status: no EPSS probability was supplied, the CVE is NOT listed in CISA KEV, and no public proof-of-concept was provided, so there is no evidence of active or imminent exploitation. One clear conflict must be called out: the input Tag 'Authentication Bypass' directly contradicts the CVSS PR:L metric - a genuine authentication bypass would be PR:N, and the Oracle description describes a low-privileged authenticated attacker, not an unauthenticated bypass; treat the tag as unreliable and the PR:L authenticated prerequisite as authoritative. Net: a credible post-authentication data-exposure risk in a widely deployed ERP platform that warrants prompt patching via the October 2026 CPU, but it is not a drop-everything issue absent exploitation evidence.

An attacker who already holds a low-privileged Oracle E-Business Suite account (e.g., a limited internal user or a compromised credential) sends crafted HTTP requests to the Applications DBA / Internal Operations component and reads sensitive data they should not be able to access, up to all data accessible to Applications DBA. The attack is network-based with low complexity and no user interaction, but authentication is required (PR:L). No public exploit code was identified in the provided data.