CVE-2026-87158

Oracle E-Business Suite's Order Management product contains an easily exploitable vulnerability in its Enterprise Command Center (ECC) component, affecting supported version V16. A low-privileged attacker with network access via HTTP — meaning any authenticated user with minimal rights, no user interaction required — can compromise Oracle Order Management. Successful exploitation yields unauthorized read access to critical data or complete access to all Order Management accessible data, plus unauthorized update, insert, or delete access to some of that data; availability is not impacted. The flaw is rated High severity with a CVSS 3.1 base score of 7.1 (C:H/I:L/A:N). It is not listed in CISA's KEV catalog, no public proof-of-concept is known, and there is no evidence of in-the-wild exploitation at this time.

What to do: Apply the Oracle Critical Patch Update that remediates this flaw in ECC V16 as soon as it is available in your patch cycle. Until patched, restrict HTTP access to Enterprise Command Center endpoints to trusted networks or VPN and enforce least-privilege on EBS accounts that can reach them. Review ECC and Order Management audit logs for anomalous data queries or unauthorized changes made by low-privileged users.