CVE-2026-87125

CVE-2026-87125 is a high-severity (CVSS 8.3) vulnerability in the Internal Operations component of Oracle Financials for Asia/Pacific, part of Oracle E-Business Suite releases 12.2.8 through 12.2.15. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, requiring no user interaction. A successful attack allows the attacker to create, delete, or modify critical data within the product, gain unauthorized read access to all data accessible to it, and cause a partial denial of service. Organizations running affected 12.2.x releases with this APAC-localized financials module are at risk, particularly if EBS web tiers are reachable from broader networks. No public proof-of-concept exists and the flaw is not on the CISA KEV list, so no exploitation is currently known.

What to do: Apply the Oracle Critical Patch Update that remedies this flaw to all E-Business Suite 12.2.8-12.2.15 environments running Financials for Asia/Pacific. Restrict HTTP access to EBS web tiers (VPN/IP allowlisting) and enforce least-privilege on application accounts, since exploitation requires only a low-privileged login. Review audit and data-change logs in the module for unauthorized modifications or access preceding the patch.