Oracle E-Business Suite: Information exposure in Valid Session
Summary
CVE-2026-87356 affects the Applications Platform Engineering component (Valid Session) of Oracle E-Business Suite versions 12.2.3 to 12.2.15. An attacker with a low-privileged account and a logon to the infrastructure where the component runs can compromise it, with high impact on confidentiality, integrity and availability (CVSS 7.8). The CWE is CWE-200 (information exposure), and the record also describes possible takeover of the component. The vulnerability is not reachable from the internet without an account.
Affected
- Oracle E-Business Suite, Applications Platform Engineering (component Valid Session)
- Versions 12.2.3 to 12.2.15
Fixed in
- Oracle's October 2026 Critical Patch Update is the reference for this CVE. The specific patch is not confirmed in the research sources.
- Check My Oracle Support Note KA923 and the EBS risk matrix in Oracle's advisory for the required patches.
Workaround
- No vendor workaround is known.
- Pending Oracle's guidance: limit the accounts with EBS logon, remove unused accounts, and keep EBS administration and middleware consoles off the public internet.
Exploitation
- No evidence of exploitation in the wild and no public proof of concept was found.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- Not confirmed in the CISA KEV catalogue (not directly verified).
- Do not confuse with CVE-2026-101767, an internet-facing EBS flaw that is being scanned.
Our recommendation
- Apply the October 2026 Critical Patch Update for E-Business Suite together with the other EBS fixes of that CPU, after verifying the patch mapping in Oracle's advisory.
- Review which accounts have EBS logon and remove unused or excessive privileges.
- Keep EBS administration and middleware consoles off the public internet and monitor logons to the EBS infrastructure.
- Verify with the customer whether EBS is in use, since its prevalence among Swiss SMEs is unknown.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory October 2026 www.oracle.com
- NVD record via Vulners vulners.com
- Strix CVE-2026-87356 www.strix.ai
- Rescana: Oracle E-Business Suite CVE-2026-101767 and October CPU www.rescana.com
- Brandefense: Oracle October 2026 CPU brandefense.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:21.
Original description (NVD)
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.