Oracle E-Business Suite CVE-2026-87402

Requires the attacker to already have a low-privileged local logon account on the infrastructure/host where Oracle E-Business Suite Applications DBA (AD Utilities component) executes, affecting versions 12.2.3 through 12.2.15. Exploitation is NOT possible remotely or unauthenticated (AV:L, PR:L). A critical limiting factor is mandatory interaction (UI:R) by a different, higher-privileged person - typically a DBA/operator who must run or act upon the affected AD Utilities operation against attacker-influenced input. Exploitation is therefore gated by shared access to the application tier and by the timing/behavior of privileged operators, which meaningfully narrows realistic exploitation beyond the raw 7.3 score.

This is a genuine but context-dependent priority rather than a drop-everything emergency. The CVSS 3.1 base score of 7.3 (HIGH) is driven by full C/I/A impact (C:H/I:H/A:H) and low attack complexity, but it is tempered by three limiting metrics: the attack vector is LOCAL (AV:L), the attacker must already hold low-level privileges (PR:L) with logon access to the infrastructure where Applications DBA executes, and successful attacks require user interaction from a person other than the attacker (UI:R). These factors mean exploitation is not remote or unauthenticated and depends on a human (likely a privileged operator/DBA) being induced to perform an action. Exploitation status: no public exploit identified at time of analysis - the CVE is not listed in CISA KEV and no POC is referenced; only the Oracle October 2026 Critical Patch Update advisory is cited. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here; absence of EPSS/KEV/POC signals suggests this is not currently seeing widespread opportunistic exploitation. CONFLICTING SIGNAL: the input Tags label this 'Information Disclosure,' yet the CVSS vector and description indicate full takeover (I:H/A:H, 'takeover of Applications DBA'), so the tag understates impact and should not be relied upon. The practical risk is highest for organizations where lower-privileged users share access to the EBS application tier and can stage content that a DBA will act upon.

A low-privileged user with logon access to the Oracle E-Business Suite application-tier host plants or alters content (e.g., a file or input consumed by an AD Utilities operation), then waits for a DBA/operator to run that utility. When the privileged user interacts with the attacker-influenced input, the flaw escalates into full compromise of the Applications DBA context. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector (AV:L, PR:L, UI:R) rather than a demonstrated POC.