Oracle E-Business Suite CVE-2026-87407

Exploitation requires a victim with access to the Oracle Applications Framework component of Oracle E-Business Suite to perform a human interaction triggered by the attacker (UI:R) - e.g., following an attacker-supplied link or request to a reachable OAF HTTP endpoint. The affected deployments are Oracle Applications Framework versions 12.2.3 through 12.2.15. The key LIMITING factors are: (1) mandatory user interaction by a person other than the attacker, which prevents fully automated or wormable exploitation; (2) network reachability of the OAF HTTP interface to the attacker and victim; and (3) that impact is confined to confidentiality (data disclosure), with no integrity or availability effect. No special non-default configuration is named in the description, so default internet- or intranet-exposed OAF instances within the affected version range are in scope once a user can be induced to interact.

This is a moderate-priority confidentiality flaw whose real-world risk sits below its headline CVSS 6.5. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) shows network-reachable, low-complexity, unauthenticated access, but the mandatory UI:R (human interaction 'from a person other than the attacker') is the dominant limiting factor - exploitation depends on tricking a legitimate user, so it cannot be mass-automated the way a pure AV:N/UI:N bug could. Impact is confidentiality-only (C:H, I:N, A:N): no data tampering or outage, only disclosure of all Oracle Applications Framework-accessible data. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no positive signal of active exploitation or weaponization; exploitation status is therefore 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. CONFLICT TO NOTE: the input Tags include 'Authentication Bypass,' but the description and vector describe an unauthenticated-but-user-interaction-gated information disclosure, not a true auth-bypass - treat the tag with skepticism and verify against Oracle's October 2026 CPU advisory. Net: patch on a normal Oracle CPU cadence; this is a real but interaction-dependent issue, not a drop-everything emergency absent exploitation evidence.

An attacker crafts a malicious HTTP link or request targeting the Oracle Applications Framework and lures an authenticated EBS user into triggering it (UI:R). When the victim interacts, the flaw discloses critical data the victim's session or the framework can reach, giving the unauthenticated attacker unauthorized read access to all OAF-accessible data. No public exploit code was identified in the provided data, and low attack complexity (AC:L) means a working lure would reliably succeed once a user engages.