CVE-2026-87162 in Contract Lifecycle Management for Public Sector
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.13-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Contract Lifecycle Management for Public Sector component of the Oracle E-Business Suite, specifically affecting versions 12.2.13 through 12.2.15. This security flaw is located in the Award/PO module and represents a critical risk to organizations relying on this software for public sector contract administration. The vulnerability stems from an insufficient access control mechanism that fails to properly enforce authorization checks when processing requests related to awarding contracts or generating purchase orders. Because the defect allows low-privileged users with network access via HTTP to execute unauthorized actions, it fundamentally undermines the principle of least privilege and breaks down the security boundaries intended to separate administrative functions from standard user operations.
From a technical perspective, this flaw is classified under CWE-269, which denotes Improper Privilege Management. The attacker does not require complex exploitation techniques or social engineering vectors such as user interaction, making it an easily exploitable threat vector. By leveraging the HTTP interface, a malicious actor with valid but low-level credentials can manipulate system processes to perform actions reserved for higher-privileged administrators. This capability allows the adversary to bypass standard authentication and authorization protocols, effectively elevating their privileges within the application environment without detection by default security controls.
The operational impact of this vulnerability is severe, as indicated by a CVSS 3.1 Base Score of 8.8, which signifies high severity across confidentiality, integrity, and availability dimensions. Successful exploitation enables an attacker to take complete control over the Oracle Contract Lifecycle Management for Public Sector instance. This takeover can lead to unauthorized modification or deletion of sensitive contract data, manipulation of financial records associated with purchase orders, and potential exposure of confidential public sector information. Furthermore, because the application is often integrated with other enterprise systems, a compromise here could serve as an entry point for lateral movement within the broader network infrastructure, escalating the risk from a single-application breach to a systemic organizational failure.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK techniques related to Privilege Escalation and Unauthorized Access via Web Services. Attackers can utilize automated tools to probe these endpoints rapidly, increasing the likelihood of successful compromise in environments where patching is delayed or access controls are loosely configured. The lack of user interaction required for exploitation means that once network access is established, whether through direct connection or subsequent phishing attacks targeting low-privileged accounts, the attack chain proceeds with minimal friction and high success probability.
To mitigate this risk, organizations must prioritize immediate application of Oracle-supplied security patches to bring affected systems up to a version where these authorization checks are corrected. In addition to patching, it is critical to review network segmentation strategies to ensure that HTTP access to E-Business Suite components is restricted to trusted IP ranges and authenticated users only. Implementing Web Application Firewalls with rules specifically tuned for Oracle E-Business Suite can provide an additional layer of defense by detecting and blocking anomalous request patterns associated with privilege escalation attempts. Regular audits of user permissions should also be conducted to ensure that low-privileged accounts do not possess unnecessary access rights to sensitive modules like Award/PO, thereby reducing the attack surface available to potential adversaries.