CVE-2026-87149

A high-severity (CVSS 3.1 base 7.1) flaw in the Award/PO component of Oracle Contract Lifecycle Management for Public Sector, part of Oracle E-Business Suite, allows a low-privileged attacker with network access via HTTP to read all data accessible to the module — including critical data — and to update, insert, or delete some of that data. Oracle rates the vulnerability as easily exploitable with no user interaction required, but exploitation requires a valid low-privileged account on the EBS instance, so the main risk is privilege escalation and data exposure by insiders or attackers using stolen credentials. Affected deployments are Oracle E-Business Suite 12.2.8 through 12.2.15 running this Public Sector module. The impact is limited to confidentiality (high) and integrity (low); availability is not affected. No public proof-of-concept is known, the flaw is not in the CISA KEV catalog, and no exploitation in the wild has been reported.

What to do: Apply the fix from Oracle's latest Critical Patch Update for E-Business Suite if you run versions 12.2.8-12.2.15 with the Public Sector Contract Lifecycle Management module. Restrict HTTP/network access to the EBS instance to trusted users and VPN ranges, and enforce least-privilege roles for module users. Review audit logs around Award/PO functionality for unexpected data reads or modifications by low-privileged accounts.