CVE-2026-87149
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data as well as unauthorized update, insert or delete access to some of Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The identified vulnerability resides within the Oracle Contract Lifecycle Management for Public Sector component of the Oracle E-Business Suite, specifically affecting versions 12.2.8 through 12.2.15. This security flaw is located in the Award/PO module and represents a significant risk to organizations relying on this platform for managing public sector contracts and procurement processes. The nature of the vulnerability allows an attacker with low privileges who has network access via HTTP to compromise the integrity and confidentiality of the system data. Such vulnerabilities are particularly concerning in enterprise environments where multiple user roles interact with sensitive financial and contractual information, as they can be leveraged by insiders or external actors who have gained initial foothold through compromised credentials or social engineering attacks.
From a technical perspective, this vulnerability enables unauthorized access to critical data and allows for the modification of existing records within the application database. The operational impact is severe, as successful exploitation results in high confidentiality impact due to the exposure of sensitive contract details, pricing structures, and bidder information. Additionally, there is a low integrity impact because attackers can insert, update, or delete specific data points related to purchase orders and award decisions. This capability undermines the trustworthiness of procurement records and could lead to fraudulent activities such as bid rigging, unauthorized fund allocation, or alteration of contractual obligations without detection by standard audit logs if proper monitoring is not in place.
In terms of industry standards classification, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-862 Missing Authorization depending on the specific implementation details of how access controls were bypassed. The attack vector corresponds to ATT&CK technique T1078 Valid Accounts if exploited by an insider or compromised user, leveraging existing network connectivity (T1043 Common Application Protocol) over HTTP. The CVSS 3.1 base score of 7.1 reflects the combination of network accessibility and low privilege requirements, indicating that while it is not a remote code execution flaw requiring zero-day exploits against unpatched systems, it poses a substantial risk due to its ease of exploitation by authenticated users with minimal permissions.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Oracle has likely released patches for this vulnerability in the latest Critical Patch Update (CPU) releases; therefore, applying the most recent security updates is the primary defense mechanism. Organizations should ensure that their E-Business Suite instances are updated to version 12.2.16 or later where possible. In addition to patching, implementing strict network segmentation can limit HTTP access to only necessary administrative interfaces and internal networks rather than exposing them broadly across public-facing DMZs. Role-based access control (RBAC) policies should be reviewed to ensure that low-privileged users do not have unnecessary write permissions on critical award or purchase order modules. Furthermore, enabling comprehensive audit logging for all data modification events within the Contract Lifecycle Management module will aid in detecting any unauthorized changes post-exploitation and support forensic analysis during incident response activities.