Oracle Applications DBA CVE-2026-87403

Exploitation requires the attacker to already have local logon access to the infrastructure/host where Oracle E-Business Suite Applications DBA (AD Utilities component) executes, holding at least a low-privileged account on that system (CVSS AV:L/PR:L). Affected deployments are EBS Applications DBA versions 12.2.3 through 12.2.15. The vector is local only - there is no network-reachable path and no user interaction is needed (UI:N), which limits exploitation to insiders or attackers who have already established a foothold on the EBS server; availability is unaffected (A:N), so the realistic risk is unauthorized data disclosure and tampering rather than service disruption.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 7.1 High) is internally consistent and points to a locally-exploitable flaw rather than a remote one: an attacker must already have logon access to the infrastructure where Applications DBA executes, and only needs low privileges once there. Impact is high for confidentiality and integrity (read/create/delete/modify all Applications DBA-accessible data) but there is no availability impact. Crucially, none of the escalating signals are present in the supplied data - no EPSS score, no CISA KEV listing, and no POC/exploit reference were provided, so exploitation status is 'no public exploit identified at time of analysis.' This tempers the otherwise-high CVSS: the local attack vector plus required authentication means this is an insider/post-compromise privilege-and-data risk rather than an internet-facing mass-exploitation threat. Note a data conflict: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires authenticated access (PR:L) and describes a 'low privileged attacker with logon' - this is not an authentication bypass, so that tag should be treated with suspicion. Overall this is a legitimate patch priority for Oracle EBS operators (especially given broad EBS deployment and the active 2026 threat interest in the suite) but it ranks below any network-reachable, unauthenticated Oracle EBS CVE in the same advisory.

A low-privileged user with shell/logon access to the host running Oracle E-Business Suite Applications DBA (e.g. a limited OS account, contractor, or an attacker who gained a foothold via another flaw) abuses an AD Utilities weakness to read and modify data owned by the Applications DBA. No special user interaction is required and attack complexity is low, but the attacker must first obtain local logon. No public proof-of-concept is identified in the provided data.