Oracle Applications Framework CVE-2026-87408

Exploitation requires the attacker to hold valid low-privileged credentials on the Oracle Applications Framework instance (PR:L) and to use the Personalization component to inject attacker-controlled content; the payload only triggers when a separate victim user interacts with the affected personalized page (UI:R), so there is no self-contained unauthenticated exploitation. Limiting factors that reduce real-world risk: a working account is required, a second human must load the malicious content, and only Oracle Applications Framework releases 12.2.3 through 12.2.15 are affected; availability is unaffected (A:N). The scope change (S:C) means the injected content can impact products beyond OAF itself, consistent with script executing in the victim's broader authenticated browser context.

This is a genuine high-priority issue for organizations running Oracle E-Business Suite, but the risk is moderated by its exploitation preconditions. The CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) reflects network reachability, low attack complexity, and a scope change, but exploitation is gated by two factors the raw score partially discounts: the attacker needs a valid low-privileged account (PR:L) and must induce interaction from another user (UI:R). The impact profile - high confidentiality and integrity, no availability, scope change, and required victim interaction - is the classic signature of a stored cross-site-scripting / content-injection flaw in a web framework, not a direct server compromise. No EPSS score, CISA KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this currently reads as a serious-but-not-emergency patch item. CONFLICT TO VERIFY: the input Tags label this 'Authentication Bypass', which is inconsistent with the vector - PR:L explicitly requires the attacker to already be authenticated, and the impact pattern points to injection/XSS rather than auth bypass; treat the tag as unreliable and rely on the CVSS vector and description.

A low-privileged but authenticated Oracle Applications Framework user abuses the Personalization component to inject malicious content into a page. When a higher-privileged user (e.g., an administrator or functional user) subsequently views that personalized page, the injected payload executes in their authenticated session, allowing the attacker to read or modify critical data accessible to the victim. No public exploit code was identified at time of analysis.