CVE-2026-87358 in General Ledger
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as unauthorized read access to a subset of Oracle General Ledger accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle General Ledger. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Internal Operations component of Oracle General Ledger, a core module in the Oracle E-Business Suite ecosystem. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The nature of this defect is characterized by its complexity, requiring an attacker to possess low-level privileges and network access via HTTP to successfully exploit it. While the difficulty of exploitation serves as a natural deterrent for opportunistic threats, the severity of the potential consequences remains high due to the critical role General Ledger plays in financial data integrity within enterprise environments. The vulnerability allows an authenticated user with minimal permissions to manipulate system behavior in ways that bypass intended access controls and operational safeguards.
From a technical perspective, this flaw represents a significant breach in both confidentiality and availability mechanisms alongside integrity protections. An attacker leveraging this weakness can achieve unauthorized creation, deletion, or modification of critical financial data. This capability directly undermines the integrity of accounting records, which are foundational to regulatory compliance and business decision-making. Furthermore, the vulnerability grants access to read operations on subsets of accessible data, exposing sensitive financial information that should remain restricted based on role-based access controls. The ability to cause a hang or induce a frequently repeatable crash constitutes a complete denial-of-service condition against the Oracle General Ledger application. This availability impact ensures that legitimate users are unable to perform essential accounting functions during an attack window, potentially disrupting daily operations and financial reporting cycles.
The operational impact of this vulnerability extends beyond immediate data loss or service interruption. In enterprise environments where Oracle E-Business Suite is deployed for managing complex financial structures, the compromise of General Ledger can lead to cascading failures across integrated modules such as accounts payable, accounts receivable, and fixed assets. The unauthorized modification of ledger entries could result in inaccurate financial statements, leading to severe regulatory penalties if discovered during audits. Additionally, the denial-of-service capability allows malicious actors to disrupt business continuity without necessarily leaving obvious traces of data tampering initially, making detection more challenging for security operations teams relying on standard monitoring tools that may not flag application-level crashes as immediate indicators of compromise unless correlated with other anomalous activities.
Mapping this vulnerability to established industry standards reveals its alignment with specific Common Weakness Enumerations and MITRE ATT&CK techniques. The unauthorized modification and creation of data correspond closely to CWE-269, which addresses Improper Privilege Management, suggesting that the application fails to enforce sufficient separation between low-level user actions and critical system functions. The ability to read restricted subsets of data aligns with CWE-862, Missing Authorization, indicating a failure in access control logic. In terms of offensive security tactics, this vulnerability facilitates lateral movement within the application layer after initial authentication is achieved. It supports techniques associated with Data Manipulation under the Impact category and potentially Defense Evasion through service disruption to mask other malicious activities. The CVSS 3.1 base score of 7.1 reflects these combined impacts on confidentiality, integrity, and availability, emphasizing that while access control requirements are moderate due to privilege constraints, the resulting damage is substantial.
Mitigation strategies must prioritize immediate patching as the primary defense mechanism. Organizations running affected versions between 12.2.3 and 12.2.15 should apply the latest security patches provided by Oracle for their specific release track. Until patches are applied, network segmentation plays a crucial role in limiting exposure. Restricting HTTP access to the General Ledger component to only trusted internal subnets or virtual private networks can reduce the attack surface available to potential adversaries. Additionally, implementing strict web application firewall rules that monitor for anomalous patterns of data modification or repeated request failures indicative of denial-of-service attempts can provide an additional layer of defense. Regular audits of user privileges within Oracle E-Business Suite are also recommended to ensure that low-privileged accounts do not possess unnecessary permissions that could be leveraged in conjunction with this vulnerability. Continuous monitoring of application logs for signs of unauthorized data changes or service instability will aid in early detection and response, minimizing the window of exposure during any potential exploitation attempts.