CVE-2026-87162

CVE-2026-87162 is a high-severity vulnerability (CVSS 3.1 base score 8.8) in the Award/PO component of Oracle Contract Lifecycle Management for Public Sector, a module of Oracle E-Business Suite. It is easily exploitable by a low-privileged, authenticated attacker who has network access to the application via HTTP. Successful exploitation can result in a complete takeover of the Oracle Contract Lifecycle Management for Public Sector application, with high impact on confidentiality, integrity, and availability. Only versions 12.2.13 through 12.2.15 are listed as affected. There is no known public proof of concept, the issue is not on the CISA Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported as of this analysis.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87162 to all E-Business Suite instances running 12.2.13-12.2.15 of Contract Lifecycle Management for Public Sector, and verify the fixed version in Oracle's advisory. Until patched, restrict HTTP access to the CLM module to trusted networks or VPN, and audit low-privilege account activity in the Award/PO component for anomalous requests. Review least-privilege role assignments in EBS to limit the pool of accounts capable of triggering the flaw.