CVE-2026-87166 in Purchasing
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Oracle Purchasing component of Oracle E-Business Suite, specifically affecting supported versions ranging from 12.2.3 through 12.2.15. This security flaw is categorized under a generic Other issue designation but represents a significant risk to enterprise resource planning environments that rely on this module for procurement and supply chain management operations. The vulnerability allows an attacker with low privileges who has network access via HTTP to compromise the integrity and confidentiality of data within the Oracle Purchasing application. Because the attack vector requires only low-privileged user credentials, it is particularly dangerous in environments where internal users may have varying levels of system access but are not necessarily administrators.
From a technical perspective, this vulnerability enables unauthorized creation, deletion, or modification of critical data accessible through the Oracle Purchasing interface. Furthermore, it grants attackers the ability to view sensitive information that should be restricted based on standard role-based access controls. The operational impact is severe, as successful exploitation can lead to complete compromise of all Oracle Purchasing accessible data. This includes financial records, supplier contracts, purchase orders, and other proprietary business intelligence stored within the system. The CVSS 3.1 base score of 8.1 reflects high impacts on both confidentiality and integrity, indicating that while availability is not directly impacted by this specific flaw, the potential for data theft and manipulation poses a critical threat to organizational security posture.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management or potentially CWE-862 Missing Authorization depending on the exact mechanism exploited within the HTTP request processing logic. The attack pattern is consistent with ATT&CK technique T1078 Valid Accounts, as it leverages legitimate but low-level credentials to perform unauthorized actions. Additionally, if the vulnerability involves manipulating data without proper validation, it may also relate to CWE-94 Improper Control of Generation of Code or CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The network-based nature via HTTP suggests that attackers could potentially exploit this remotely over a LAN or WAN, provided they can authenticate with low-level credentials and traverse any intermediate firewalls or access control lists that permit such traffic.
Mitigation strategies must prioritize immediate patching by applying the latest Oracle E-Business Suite security patches released for versions 12.2.3 through 12.2.15. Organizations should verify their current version against this range to determine exposure. In addition to patching, it is crucial to enforce strict role-based access controls within the application, ensuring that users with low privileges do not have unnecessary permissions related to data modification or viewing sensitive procurement records. Network segmentation can also help limit lateral movement by restricting HTTP access to Oracle E-Business Suite servers from untrusted networks. Regular auditing of user activities and monitoring for anomalous data changes should be implemented to detect potential exploitation attempts early. Continuous security assessments and penetration testing focused on the purchasing module are recommended to identify any residual risks or misconfigurations that could facilitate similar attacks in the future.