CVE-2026-87150

CVE-2026-87150 is a high-severity (CVSS 8.8) vulnerability in the Setup Workbench component of Oracle Bills of Material, part of Oracle E-Business Suite releases 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged, authenticated attacker who has network access to the EBS instance over HTTP. A successful attack allows the attacker to fully take over Oracle Bills of Material, with high impact on the confidentiality, integrity, and availability of that component's data. Any organization running an affected 12.2.x release with the Bills of Material product exposed to users is affected, including instances reachable from untrusted or internal networks. No public proof-of-concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so there is no indication of active exploitation at this time.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87150 to all EBS 12.2.3-12.2.15 environments running Bills of Material, prioritizing any instance reachable over HTTP from untrusted networks. Restrict network access to EBS web entry points (firewall/VPN), audit low-privileged accounts for anomalous activity against Setup Workbench, and verify the patch level of all 12.2.x middleware and database tiers.