CVE-2026-87335 in Applications DBA
Summary
by MITRE • 10/21/2026
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Applications DBA. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the Applications DBA component of Oracle E-Business Suite represents a significant security risk for organizations relying on this enterprise resource planning platform. Specifically affecting supported versions ranging from 12.2.3 through 12.2.15, this flaw resides in the Internal Operations module which handles critical administrative functions. The nature of this vulnerability allows an attacker with low privileges and network access via HTTP to compromise the integrity of the Applications DBA subsystem. This classification indicates that while elevated permissions are not required for initial exploitation, the ability to interact with the system over a standard web protocol provides a wide attack surface accessible from remote locations if proper segmentation is not in place.
From a technical perspective, the core issue stems from insufficient access control mechanisms within the Internal Operations interface. The flaw enables unauthorized actors to bypass intended restrictions and execute operations that should be reserved for higher-privileged administrators or restricted internal processes. This misalignment between user privilege levels and system permissions allows low privileged users to perform actions beyond their authorized scope. Such a failure in enforcing least privilege principles is characteristic of improper authorization checks, where the application fails to verify whether the authenticated user has sufficient rights to access specific resources or execute particular commands before processing the request.
The operational impact of this vulnerability is severe due to its direct effect on data confidentiality. Successful exploitation can lead to unauthorized access to critical business data stored within the E-Business Suite environment. In worst-case scenarios, an attacker could gain complete access to all Applications DBA accessible data, which may include sensitive financial records, customer information, employee details, and proprietary intellectual property. The CVSS 3.1 base score of 6.5 reflects a medium severity rating primarily driven by high confidentiality impacts with no direct impact on integrity or availability in the baseline vector. This means that while system uptime remains unaffected, the exposure of sensitive data poses substantial regulatory compliance risks including violations of GDPR, HIPAA, or SOX depending on the industry sector and geographic location of the organization.
Mapping this vulnerability to established security frameworks provides further context for remediation efforts. The flaw aligns with CWE-269 Improper Privilege Management as it involves a low privileged user gaining unauthorized access to resources. Additionally, it relates to CWE-862 Missing Authorization where the application does not properly verify permissions before allowing data retrieval or modification. From an adversary perspective, this vulnerability facilitates ATT&CK technique T1078 Valid Accounts since exploitation relies on using legitimate but insufficiently restricted credentials. It also supports lateral movement and data exfiltration phases by providing a foothold within the internal network infrastructure through standard HTTP traffic which may bypass perimeter security controls that do not inspect application-layer content deeply enough to detect such logic flaws.
Mitigation strategies must prioritize immediate patching of all affected Oracle E-Business Suite instances to version 12.2.16 or later where this issue has been resolved by the vendor. Organizations should also implement network segmentation to restrict HTTP access to the Applications DBA interface strictly from trusted administrative workstations rather than exposing it broadly across the corporate LAN or internet. Implementing a Web Application Firewall with rules tuned to detect abnormal privilege escalation patterns can provide an additional layer of defense in depth. Furthermore, enforcing multi-factor authentication for all database administrator accounts and reviewing existing user roles ensures that even if this specific vulnerability is exploited, the attacker's ability to move laterally or exfiltrate data remains constrained by stronger identity verification protocols. Regular audits of access control lists within E-Business Suite will help maintain proper privilege boundaries and reduce the risk profile associated with internal operations components.