Oracle E-Business Suite CVE-2026-87356

Exploitation requires the attacker to already possess an authenticated low-privileged logon (PR:L) to the infrastructure/host on which the Applications Platform Engineering component of Oracle E-Business Suite executes, and the installed version must fall within 12.2.3 through 12.2.15. Attack complexity is low and no user interaction is needed (AC:L/UI:N), but the AV:L vector means there is no remote network path - the single biggest limiting factor is the prerequisite of local authenticated access to the EBS server, which confines realistic exploitation to insiders or to attackers who have already gained a foothold on the host.

The input CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally exploitable flaw requiring an already-authenticated low-privileged account on the host where Applications Platform Engineering runs, with low attack complexity and no user interaction, yielding full confidentiality, integrity and availability loss (component takeover). This is an authenticated local privilege-escalation / component-compromise issue, NOT a remotely reachable, unauthenticated vulnerability - the AV:L vector is the single most important risk-limiting signal and should temper the otherwise-high 7.8 score. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no evidence of active or likely-imminent exploitation; the high CVSS is driven by impact (C/I/A all High) rather than by ease of remote reach. No SSVC decision data was provided. Net: a genuine priority for Oracle E-Business Suite operators to patch in the normal CPU cycle, but it is not a drop-everything, internet-facing emergency - an attacker must first obtain local authenticated access. CONFLICT TO NOTE: the input Tag 'Information Disclosure' understates the vulnerability, which the description and CVSS (I:H/A:H) characterize as a full takeover, not mere disclosure - treat the impact as full compromise.

A low-privileged user who already has an authenticated local logon to the server hosting Oracle E-Business Suite's Applications Platform Engineering component abuses a flaw in the Valid Session handling to escalate to full control of that component. Because AC:L/UI:N, the attacker needs no victim interaction and no special timing once local access is held. No public exploit code was identified at time of analysis, so this would require attacker-developed tooling or internal knowledge.