CVE-2026-87163 in Purchasing
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Purchasing component of Oracle E-Business Suite, specifically affecting supported versions ranging from 12.2.3 through 12.2.15. This security flaw is categorized under a general Other issue designation but carries significant severity implications for enterprise environments relying on this software for procurement and supply chain management operations. The vulnerability allows an attacker with low privileges to achieve complete compromise of the Oracle Purchasing application, indicating a critical failure in access control or input validation mechanisms that are fundamental to maintaining system integrity.
From a technical perspective, the exploitability vector is network-based via HTTP, which means remote attackers can trigger the flaw without requiring physical proximity or local account creation on the target server. The requirement for low-privileged access suggests that the vulnerability likely stems from insufficient authorization checks within specific API endpoints or web services exposed by the application tier. An attacker leveraging this weakness does not need user interaction to succeed, as indicated by the absence of a UI component in the CVSS vector, allowing for automated exploitation against any authenticated but unprivileged user account. This characteristic significantly lowers the barrier to entry for malicious actors compared to vulnerabilities requiring social engineering or complex multi-step interactions.
The operational impact of this vulnerability is severe, with a CVSS 3.1 Base Score of 8.8 reflecting high impacts on confidentiality, integrity, and availability. A successful exploitation results in full takeover of Oracle Purchasing, enabling the attacker to read sensitive financial data, modify purchase orders or vendor information without authorization, and potentially disrupt procurement workflows by deleting critical records or injecting malicious configurations. This level of compromise can lead to substantial financial loss, regulatory non-compliance due to exposure of protected business data, and operational downtime that affects downstream supply chain activities dependent on accurate purchasing records.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management or CWE-862 Missing Authorization, as the core issue involves a low-privileged user gaining elevated control over application functions they should not access. Furthermore, from an ATT&CK framework perspective, this relates to techniques involving Initial Access via valid accounts and subsequent Lateral Movement or Defense Evasion if the attacker uses the compromised purchasing module to pivot further into the enterprise network. The high availability impact also suggests potential for Denial of Service conditions through resource exhaustion or system instability caused by malformed requests exploiting the underlying flaw.
Mitigation strategies must prioritize immediate patching using Oracle Critical Patch Update releases that address this specific vulnerability in versions 12.2.3 to 12.2.15. Organizations should verify their current version and apply the latest security patches provided by Oracle as soon as possible. In environments where patching is delayed due to operational constraints, network segmentation strategies should be implemented to restrict HTTP access to the Oracle E-Business Suite application tier from untrusted networks or low-privileged user segments. Additionally, implementing Web Application Firewalls with rules specifically tuned to detect anomalous requests targeting purchasing modules can provide an additional layer of defense by blocking exploit attempts before they reach the vulnerable code paths. Regular auditing of privileged account usage and monitoring for unusual activity within the purchasing module are also recommended to detect potential exploitation in real-time.