CVE-2026-87404 in Pasta
Summary
by MITRE • 10/21/2026
Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta. Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the Pasta printing engine component of Oracle E-Business Suite represents a significant security risk for organizations relying on this enterprise resource planning platform. The affected versions span from 12.2.3 through 12.2.15, indicating that a substantial portion of deployed instances may be susceptible to exploitation if they have not been patched or upgraded to the latest supported release. Pasta serves as the core printing subsystem for Oracle E-Business Suite, handling document generation and output management across various modules including financials, human resources, and supply chain operations. A compromise in this component can disrupt critical business processes that depend on accurate and timely report delivery, making it a high-value target for attackers seeking to impact organizational continuity.
The technical nature of this flaw is characterized by its difficulty to exploit, which suggests the presence of complex conditions or specific sequences required to trigger the vulnerability successfully. Despite this complexity, the attack vector remains network-based via HTTP, allowing remote exploitation without requiring physical access or user interaction beyond initial connection establishment. The requirement for low-privileged authentication means that an attacker does not need administrative credentials to initiate the exploit, significantly lowering the barrier to entry compared to vulnerabilities requiring high-level privileges. This combination of network accessibility and lower privilege requirements makes it feasible for threat actors with basic scripting knowledge or automated tools to attempt exploitation against vulnerable systems exposed to untrusted networks or those where internal user accounts have been compromised through other means such as phishing or credential stuffing attacks.
Successful exploitation results in a complete takeover of the Pasta process, which effectively grants the attacker control over the printing engine's execution context within the Oracle E-Business Suite environment. This level of compromise aligns with severe impacts on confidentiality, integrity, and availability as reflected by the CVSS 3.1 base score of 7.5. In terms of confidentiality, an attacker could potentially access sensitive documents being processed or generated through the printing engine, including financial reports, employee records, or proprietary business data. Regarding integrity, the ability to take over the process allows for the modification or injection of malicious content into printed outputs, which can lead to fraud or misinformation dissemination within the organization. For availability, disrupting the Pasta service can halt report generation capabilities, causing operational delays and productivity losses across departments that rely on these automated workflows.
From a classification perspective, this vulnerability likely maps to CWE-20 Improper Input Validation if the flaw stems from inadequate sanitization of HTTP request parameters or headers passed to the printing engine. It may also relate to CWE-78 OS Command Injection if the takeover involves executing arbitrary system commands through the Pasta process context. In terms of MITRE ATT&CK framework alignment, this vulnerability facilitates initial access and privilege escalation tactics, potentially leading to lateral movement within the network as the compromised Pasta service could be used as a pivot point for further attacks against other components of the E-Business Suite or connected systems. The low attack complexity noted in the CVSS vector suggests that while exploitation is not trivial, it does not require highly specialized conditions beyond standard HTTP interactions and valid but low-privileged credentials.
Mitigation strategies should prioritize immediate patching to the latest supported version of Oracle E-Business Suite as recommended by official security advisories from Oracle. Organizations must ensure their update cycles are aligned with critical security releases to minimize exposure windows. In addition to software updates, implementing strict network segmentation is crucial; the Pasta service and associated HTTP endpoints should not be directly accessible from untrusted networks or the public internet. Access controls should enforce strong authentication mechanisms for all users interacting with the printing subsystem, including multi-factor authentication where feasible. Monitoring solutions should be configured to detect anomalous behavior in HTTP traffic directed at Oracle E-Business Suite services, particularly focusing on unusual request patterns that might indicate exploitation attempts. Regular vulnerability scanning and penetration testing focused on web application components can help identify similar weaknesses before they are exploited by malicious actors.