CVE-2026-87126

CVE-2026-87126 is a vulnerability in the Reports Security component of Oracle Report Manager, part of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can trigger the flaw, which Oracle rates as easily exploitable with no user interaction required. A successful attack lets the attacker read critical data or all Oracle Report Manager accessible data, and to cause a partial denial of service of the component; integrity is not impacted. Any organization running E-Business Suite 12.2.3-12.2.15 with Report Manager exposed to users or networks is affected, particularly deployments reachable from the internet or broad internal networks. The issue is not on CISA's KEV list and no public proof-of-concept or observed exploitation is known, but an authenticated account is the only real barrier.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87126 to all E-Business Suite 12.2.3-12.2.15 environments running Report Manager, prioritizing any instance whose HTTP endpoints are internet-facing. Restrict network access to EBS web tiers (segmentation, VPN, WAF rules) and audit low-privileged accounts with access to reporting functions. Review Report Manager access logs and report-generation history around and before the patch date for signs of unauthorized data reads or abuse-driven report failures.