CVE-2026-87402 in Applications DBA
Summary
by MITRE • 10/21/2026
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the AD Utilities component of Oracle E-Business Suite Applications DBA, specifically affecting supported versions ranging from 12.2.3 through 12.2.15. This security flaw represents a significant risk to enterprise environments relying on this legacy ERP platform for critical business operations. The core issue stems from improper handling of user-supplied input or insufficient validation mechanisms within the AD Utilities scripts, which are frequently used for system administration tasks such as patching, cloning, and configuration management. Because these utilities operate with elevated privileges relative to standard application users, any exploitation can lead to a complete compromise of the underlying Applications DBA environment. The vulnerability is classified under CWE-94 Improper Control of Generation of Code (Code Injection) or potentially CWE-78 OS Command Injection, depending on the specific vector utilized by the attacker to execute arbitrary commands within the context of the database server or application tier processes.
Exploitation of this flaw requires a low privileged attacker who has valid logon credentials to the infrastructure where Applications DBA executes. This means that an insider threat or an external actor who has gained initial access through phishing, credential theft, or other lateral movement techniques can leverage this vulnerability. The requirement for human interaction indicates that the attack likely involves social engineering tactics, such as tricking a system administrator into executing a maliciously crafted script or command within the AD Utilities framework. This dependency on user action aligns with ATT&CK technique T1059 Command and Scripting Interpreter, where attackers use scripts to execute commands and control systems. The presence of this requirement does not diminish the severity but rather highlights the importance of security awareness training alongside technical controls.
The operational impact of a successful exploitation is severe, resulting in full takeover of Applications DBA with a CVSS 3.1 Base Score of 7.3, categorized as High Severity. This score reflects high impacts on Confidentiality, Integrity, and Availability. An attacker achieving this level of access can read sensitive financial data, modify transaction records to conceal fraud or manipulate business outcomes, and disrupt service availability by crashing critical database services or application tiers. The ability to take over Applications DBA effectively grants the attacker control over the entire E-Business Suite instance, potentially leading to broader network compromise if the database server is integrated with other enterprise systems. This aligns with ATT&CK tactic T1078 Valid Accounts and T1546 Event Triggered Execution, as the attacker leverages legitimate credentials and system mechanisms to maintain persistence and escalate privileges.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Oracle has released patches for this vulnerability in its Critical Patch Update releases; organizations should immediately apply the latest security updates for their specific version of Applications DBA within the 12.2.x range. In addition to patching, administrators should enforce strict least privilege principles by ensuring that only authorized personnel have access to execute AD Utilities scripts. Implementing multi-factor authentication for administrative accounts can significantly reduce the risk of credential theft leading to exploitation. Furthermore, organizations should review and harden their script execution policies, potentially using application whitelisting or restricted shell environments to prevent unauthorized command injection. Regular auditing of user activities within the E-Business Suite environment is also recommended to detect any anomalous behavior indicative of an ongoing attack attempt.