CVE-2026-87163

CVE-2026-87163 is a high-severity (CVSS 8.8) vulnerability in the Oracle Purchasing module of Oracle E-Business Suite, affecting supported releases 12.2.3 through 12.2.15. It is triggered remotely over HTTP by an attacker who already holds a low-privileged account on the EBS instance, requiring no user interaction or special conditions. A successful attack lets the attacker fully compromise Oracle Purchasing, with high impact on the confidentiality, integrity, and availability of that component. Any organization running EBS 12.2.3-12.2.15 with the Purchasing module reachable over the network is affected, particularly instances exposed to the internet. No public proof-of-concept exists and no exploitation in the wild has been reported; the flaw is not on the CISA KEV list.

What to do: Apply the Oracle Critical Patch Update that delivers the fix for CVE-2026-87163 to all EBS 12.2.3-12.2.15 environments running Purchasing, prioritizing any instance reachable over the network. Restrict HTTP access to EBS via VPN/IP allowlisting so that low-privileged self-service and supplier accounts cannot reach vulnerable endpoints from untrusted networks. Review user account provisioning in Purchasing and audit logs for anomalous activity by low-privilege accounts as an interim detection measure.