CVE-2026-87357 in Order Capture
Summary
by MITRE • 10/21/2026
Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture. Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Order Capture component of Oracle E-Business Suite, specifically affecting versions ranging from 12.2.3 through 12.2.15 under the Internal Operations module. This security flaw represents a critical risk to organizations relying on this enterprise resource planning software for managing sales and order processing workflows. The vulnerability is characterized by its potential for remote exploitation over standard HTTP protocols, which allows an attacker with network connectivity to interact directly with the affected application layer without requiring user interaction or complex social engineering tactics.
From a technical perspective, the core issue stems from insufficient validation of input data or improper access control mechanisms within the internal operations logic that handles order capture requests. Although the vulnerability requires high-privileged credentials for initial exploitation, this does not mitigate the severity because it indicates a failure in enforcing least privilege principles at the application level. An attacker who has obtained valid administrative credentials through phishing, credential stuffing, or other means can leverage these privileges to send specially crafted HTTP requests that trigger the underlying flaw. The absence of adequate sanitization or authorization checks allows the malicious input to execute unintended commands or manipulate internal state variables in a way that bypasses standard security boundaries.
The operational impact of this vulnerability is severe, as indicated by its CVSS 3.1 base score of 7.2 and the vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The high scores for Confidentiality, Integrity, and Availability reflect that a successful exploit leads to complete compromise of the Order Capture subsystem. This effectively results in full takeover of the component by the attacker. In practical terms, this means an adversary could exfiltrate sensitive customer data including personally identifiable information and financial details, alter order records to manipulate business outcomes or commit fraud, and disrupt service availability causing significant operational downtime for sales and fulfillment teams. The ability to compromise integrity is particularly dangerous in enterprise environments where accurate transactional data is critical for supply chain management and revenue recognition.
This vulnerability aligns with Common Weakness Enumeration categories such as CWE-287 Improper Authentication or CWE-918 Server-Side Request Forgery depending on the specific technical root cause, though it generally falls under broader classes of insecure direct object references or broken access control within web applications. In terms of MITRE ATT&CK framework mapping, this exploit scenario corresponds to techniques involving Initial Access via valid credentials and subsequent Execution through application-level commands. The attack path typically involves Reconnaissance followed by Credential Access if the high-privilege account was not already compromised, then Exploitation for Client/Server Privilege Escalation within the context of the Oracle E-Business Suite environment.
Mitigation strategies must prioritize immediate patching to the latest supported version of Oracle E-Business Suite that includes the security fix for this specific vulnerability in the Order Capture module. Organizations should verify their current deployment against the affected range and apply the relevant interim patches or release updates provided by Oracle. In addition to software remediation, it is crucial to enforce strict network segmentation policies to limit HTTP access to internal operations components from untrusted networks. Implementing Web Application Firewalls with rulesets tuned for detecting anomalous request patterns associated with this flaw can provide an additional layer of defense. Furthermore, enforcing multi-factor authentication and rigorous monitoring of privileged account usage will reduce the likelihood that high-privileged credentials are compromised in the first place, thereby neutralizing the primary prerequisite for exploiting this vulnerability.