CVE-2026-87158 in Order Management
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Enterprise Command Center). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Order Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Enterprise Command Center component of Oracle Order Management, a critical module in the Oracle E-Business Suite ecosystem specifically version 16. This security flaw represents a significant risk to organizations relying on this enterprise resource planning software for managing their supply chain and order processing workflows. The core issue stems from an improper access control mechanism that fails to adequately restrict user permissions within the application layer. Specifically, the vulnerability allows low-privileged attackers who possess valid network access via HTTP to bypass intended security restrictions. This misconfiguration enables unauthorized actors to interact with sensitive data structures without requiring elevated privileges or complex exploitation techniques, highlighting a fundamental weakness in how authentication and authorization checks are implemented for specific endpoints or functions within the Enterprise Command Center interface.
From an operational perspective, the impact of this vulnerability is severe due to its high exploitability and broad scope. The CVSS 3.1 base score of 7.1 reflects substantial risks to both confidentiality and integrity, while availability remains largely unaffected in the immediate context of this specific flaw. Successful exploitation allows attackers to gain unauthorized access to critical business data, potentially exposing sensitive customer information, financial records, or proprietary operational metrics. Furthermore, the vulnerability permits unauthorized modifications to the database state, including updates, inserts, and deletes on accessible data sets. This capability not only compromises data integrity but also poses a risk of data corruption or loss if malicious actors choose to alter or remove essential order management records. The ability to perform write operations with low-privileged credentials significantly amplifies the potential for business disruption and regulatory non-compliance, particularly under frameworks such as GDPR or HIPAA where data protection is paramount.
In terms of industry-standard classification, this vulnerability aligns closely with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. The attack vector corresponds to ATT&CK technique T1078 Valid Accounts, as the attacker leverages existing low-level credentials rather than exploiting a zero-day authentication bypass. Additionally, the ability to modify data relates to MITRE ATT&CK tactic TA0043 Impact and techniques such as Data Manipulation or Account Modification depending on the specific actions taken by the adversary. The network-based nature of the attack via HTTP indicates that this is not an isolated local issue but a remote exploitable flaw accessible over standard web protocols, increasing the surface area for potential compromise across distributed enterprise environments.
Mitigation strategies must focus on immediate remediation and long-term security hardening. Oracle has likely released patches addressing this specific vulnerability within the Enterprise Command Center component; therefore, applying the latest available updates to Oracle E-Business Suite version 16 is the primary corrective action. Organizations should verify their patch levels against Oracle Critical Patch Update advisories to ensure all relevant hotfixes are installed. In addition to software updates, implementing strict network segmentation can limit exposure by restricting HTTP access to the Enterprise Command Center interface only from trusted internal subnets or through secure virtual private networks rather than exposing it directly to untrusted networks. Web Application Firewalls should be configured with rulesets that detect and block anomalous patterns associated with privilege escalation attempts or unauthorized data manipulation requests targeting known vulnerable endpoints. Regular security audits and penetration testing focused on access control mechanisms will help identify similar misconfigurations before they can be exploited by malicious actors, ensuring the integrity of critical order management operations remains intact.