Oracle Order Capture CVE-2026-87357

Exploitation requires the attacker to already hold a HIGH-PRIVILEGE Oracle E-Business Suite account (CVSS PR:H) with network HTTP access to the Order Capture product's Internal Operations component; this authenticated privileged-access requirement is the primary limiting factor and rules out anonymous external attackers. The flaw affects EBS Order Capture versions 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once the privileged account is held, exploitation is straightforward over the network. No special non-default feature or configuration toggle is cited in the description beyond the standard presence of the Order Capture / Internal Operations component.

This is a genuine but conditional risk that falls short of top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, score 7.2 HIGH) describes network-reachable, low-complexity exploitation requiring no user interaction, but critically demands high privileges (PR:H) - meaning an attacker must already hold a privileged/administrative Oracle E-Business Suite account before they can achieve the full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) that results in takeover of Order Capture. This PR:H prerequisite is the dominant risk-limiting factor and distinguishes this from an unauthenticated internet-facing threat. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no POC was supplied, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data (automatable, exploitation, technical impact) was provided. The signals are internally consistent - a high-impact-but-high-privilege flaw typical of the Oracle Critical Patch Update cycle - so this is a real patch-worthy issue but better treated as a routine CPU-cycle remediation than an emergency, given the privileged-access barrier and absence of any active-exploitation or POC evidence.

An attacker who has already obtained a high-privileged Oracle E-Business Suite account (for example, a compromised administrative or operator credential) sends crafted HTTP requests over the network to the Order Capture component's Internal Operations functionality. By abusing the flaw, the attacker escalates from their existing privileged foothold to a complete takeover of Order Capture, gaining full read/write control and the ability to disrupt the service. No public exploit code or active exploitation has been identified for this vulnerability.