CVE-2026-87165 in Contract Lifecycle Management for Public Sector
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: ECC For Award and IDV). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Contract Lifecycle Management for Public Sector component of Oracle E-Business Suite, specifically affecting version 16 under the ECC For Award and IDV module. This security flaw represents a critical risk to organizations relying on this platform for managing public sector contracts, as it allows an attacker with low privileges and network access via HTTP to compromise the system. The severity is quantified by a CVSS 3.1 Base Score of 8.8, indicating a high-severity vulnerability that significantly impacts confidentiality, integrity, and availability. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based, requires low complexity, does not require user interaction, involves privileged access but no scope change, and results in high impacts across all three security pillars.
From a technical perspective, this vulnerability likely stems from insufficient input validation or improper authorization checks within the awarding and independent distribution vendor workflows. Such flaws typically allow an authenticated attacker to manipulate data structures or execute unauthorized commands by exploiting gaps in how the application processes HTTP requests. The ability for low-privileged users to achieve full system takeover suggests a severe breakdown in role-based access control mechanisms, potentially allowing privilege escalation through crafted inputs that bypass existing security boundaries. This aligns with common vulnerability classes such as Broken Access Control (CWE-269) or Injection flaws (CWE-78/CWE-89), where the application fails to properly distinguish between authorized and unauthorized actions based on user credentials.
The operational impact of this vulnerability is severe, enabling a complete compromise of the Oracle Contract Lifecycle Management environment. An attacker could exfiltrate sensitive contract data, alter award decisions or vendor information, or disrupt service availability by crashing critical processes. In the context of public sector operations, such integrity violations can lead to significant financial loss, legal liabilities, and erosion of trust in procurement processes. The high confidentiality impact means that proprietary bidding strategies, personal identifiable information of vendors, and internal government deliberations could be exposed. Simultaneously, the availability impact implies potential denial-of-service conditions or system instability resulting from malicious exploitation attempts.
Mitigation efforts must prioritize immediate patching to the latest available version provided by Oracle, which addresses the underlying code defects responsible for this privilege escalation path. Organizations should also implement strict network segmentation to limit HTTP access to only necessary administrative interfaces and enforce multi-factor authentication for all user accounts to reduce the risk of credential compromise leading to exploitation. Additionally, deploying Web Application Firewalls with rules tailored to detect common injection patterns or unauthorized API calls can provide an additional layer of defense. Continuous monitoring using intrusion detection systems aligned with MITRE ATT&CK techniques such as T1078 (Valid Accounts) and T1059 (Command and Scripting Interpreter) will help in identifying potential exploitation attempts before they result in full system takeover. Regular security assessments and penetration testing focused on the ECC For Award module are recommended to ensure that similar access control weaknesses do not persist in other areas of the application.