CVE-2026-87150
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The identified vulnerability resides within the Setup Workbench component of Oracle Bills of Material, a critical module within the Oracle E-Business Suite ecosystem. This specific flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The nature of this defect represents a significant security risk because it permits an attacker with low privileges and network access via HTTP to compromise the integrity, confidentiality, and availability of the Oracle Bills of Material application. Such vulnerabilities are particularly dangerous in enterprise environments where E-Business Suite is often integrated deeply into core operational workflows involving supply chain management, manufacturing processes, and financial planning. The ability for a low-privileged user to escalate their influence or execute unauthorized actions can lead to severe disruptions in business operations and potential data exfiltration of sensitive intellectual property related to product structures and costs.
From a technical perspective, the vulnerability allows an attacker with network access via HTTP to exploit flaws within the Setup Workbench interface. The high severity score indicates that the attack vector is remote and requires low complexity, meaning no user interaction such as clicking malicious links or opening crafted files is necessary for exploitation. This aligns closely with CWE-269, which describes Improper Privilege Control, suggesting that the application fails to adequately verify permissions before allowing certain administrative or sensitive operations. Furthermore, because the impact encompasses confidentiality, integrity, and availability, it suggests potential outcomes such as unauthorized data access, modification of critical bill-of-material records, or denial of service conditions that could halt production planning activities. The CVSS 3.1 base score of 8.8 reflects these severe consequences, emphasizing the urgent need for remediation to prevent takeover of the application context by malicious actors who may have already infiltrated the network perimeter with low-level credentials.
The operational impact of this vulnerability extends beyond immediate system compromise to broader organizational risks. Oracle Bills of Material serves as a foundational data structure defining how products are assembled from components, sub-assemblies, and raw materials. If an attacker gains control over this module through exploitation of this flaw, they could alter production recipes, introduce defective component lists, or steal proprietary manufacturing details that provide competitive advantage to rivals. Additionally, the compromise of confidentiality impacts sensitive cost data and supplier information, while integrity violations can lead to incorrect procurement orders and inventory discrepancies. Availability issues may disrupt just-in-time manufacturing processes, leading to significant financial losses due to downtime. These risks are compounded by the fact that E-Business Suite is often a central hub for enterprise resource planning, meaning lateral movement from this compromised module could potentially expose other integrated systems within the organization's IT infrastructure.
To mitigate these risks, organizations running affected versions of Oracle E-Business Suite must prioritize applying the latest security patches provided by Oracle immediately. It is essential to verify that all instances of the Setup Workbench component are updated to a version beyond 12.2.15 or receive the specific interim fixes released for this vulnerability. In addition to patching, implementing strict network segmentation can help limit exposure by ensuring that only authorized systems and users have HTTP access to the E-Business Suite environment. Deploying web application firewalls with rules tailored to detect exploitation attempts against known vulnerabilities in Oracle applications can provide an additional layer of defense. Furthermore, enforcing multi-factor authentication for all user accounts, even those with low privileges, reduces the likelihood of credential-based attacks that could precede or accompany this vulnerability's exploitation. Regular security assessments and penetration testing should be conducted to identify any other potential weaknesses within the E-Business Suite architecture before they can be leveraged by adversaries seeking to compromise critical business functions.