CVE-2026-87169 in Contract Lifecycle Management for Public Sector
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Wage Determination Online). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Contract Lifecycle Management for Public Sector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Contract Lifecycle Management for Public Sector accessible data as well as unauthorized read access to a subset of Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Wage Determination Online component of Oracle Contract Lifecycle Management for Public Sector, a critical module within the broader Oracle E-Business Suite ecosystem designed to manage public sector contracting and compliance. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The core technical issue stems from an insufficient authentication mechanism or improper access control validation that permits unauthenticated actors to interact with sensitive application functions over the Hypertext Transfer Protocol. Unlike many vulnerabilities that require complex exploitation chains, this flaw is characterized by its ease of exploitability and low attack complexity, allowing a remote attacker with standard network connectivity to initiate malicious requests without prior credentials.
The operational impact of this vulnerability extends beyond the immediate scope of the Contract Lifecycle Management module due to potential cross-product side effects within the integrated Oracle E-Business Suite environment. Successful exploitation allows an unauthenticated user to perform unauthorized read operations on a subset of accessible data, leading to significant confidentiality breaches where sensitive contract details, wage determination records, or proprietary public sector information may be exfiltrated. Furthermore, the vulnerability grants unauthorized write capabilities, enabling attackers to update, insert, or delete critical data entries. This integrity compromise can lead to severe operational disruptions, including the manipulation of legal contracts, alteration of financial obligations, and corruption of audit trails essential for regulatory compliance in public sector operations.
A defining characteristic of this specific flaw is its reliance on human interaction as a prerequisite for successful exploitation. While the technical vector allows network-based access without authentication, the attack chain requires a victim user to perform an action that triggers the malicious payload or state change. This aligns with social engineering vectors where trust in legitimate application interfaces is exploited. The presence of this requirement classifies the vulnerability under CWE-79, which pertains to Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting, or potentially CWE-20 if it involves improper input validation leading to state manipulation. In terms of offensive security frameworks, this behavior maps closely to ATT&CK technique T1566.001, specifically Phishing: Spearphishing Attachment or Link, depending on whether the trigger is a malicious link or file interaction within the application interface.
The severity of this vulnerability is quantified by a CVSS 3.1 Base Score of 6.1, indicating a medium level of risk that demands prompt attention despite not being immediately critical in terms of availability impact. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) highlights the unique combination of network accessibility and low complexity balanced against the requirement for user interaction and scope change. The Scope Change indicator is particularly significant, as it confirms that compromising this component can lead to privilege escalation or data exposure in other integrated Oracle products within the suite, thereby amplifying the overall risk posture for organizations relying on these interconnected systems.
Mitigation strategies must address both immediate technical controls and long-term architectural improvements. Organizations should immediately apply the latest security patches provided by Oracle for versions 12.2.3 through 12.2.15 to close the authentication bypass gap. In environments where patching is delayed, network segmentation and strict firewall rules restricting HTTP access to this specific component from untrusted networks are essential defensive measures. Additionally, implementing Web Application Firewalls with advanced behavioral analysis can help detect and block anomalous request patterns associated with exploitation attempts. From a user perspective, security awareness training focused on recognizing suspicious interactions within the application interface is crucial given the human interaction requirement of the exploit. Regular audits of access logs for this component should also be conducted to identify any potential unauthorized read or write activities that may have occurred prior to remediation.