CVE-2026-87157

CVE-2026-87157 is a vulnerability in the Oracle Order Management product of Oracle E-Business Suite, specifically in its Product Diagnostic Tools component, affecting releases 12.2.4 through 12.2.15. It is easily exploitable by a low-privileged (authenticated) attacker who has network access to the EBS HTTP endpoint, requiring no user interaction. Successful exploitation allows the attacker to create, delete, or modify critical data — or all data accessible to Oracle Order Management — as well as to read that data, giving high impact to both confidentiality and integrity (CVSS 3.1 base score 8.1, no availability impact). Any organization running an affected E-Business Suite 12.2 release with Order Management exposed to users over the network is potentially affected. The flaw is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept or observed in-the-wild exploitation is known.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE to all E-Business Suite 12.2.4-12.2.15 environments running Order Management. Restrict HTTP/HTTPS access to EBS to trusted networks or VPN, enforce least-privilege roles for accounts that only need limited Order Management functions, and disable or tightly gate the Product Diagnostic Tools component if not required. Review audit logs and Order Management data-change history for unauthorized creations, modifications, or deletions by low-privileged accounts.