CVE-2026-87165

Oracle Contract Lifecycle Management for Public Sector, a module of Oracle E-Business Suite (component: ECC For Award and IDV), contains an easily exploitable vulnerability affecting supported version V16. A remote attacker with only low-privileged network access via HTTP can exploit it to fully compromise the CLM for Public Sector application. Successful attacks result in complete takeover, with high impact on the confidentiality, integrity, and availability of the affected software (CVSS 3.1 base score 8.8). Organizations running this public-sector procurement module on E-Business Suite V16 are affected. No public proof-of-concept exists and the flaw is not on the CISA KEV catalog, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-87165 to all Contract Lifecycle Management for Public Sector V16 deployments. Restrict HTTP/network access to the EBS CLM and ECC endpoints to trusted users and networks, and enforce least privilege so low-privileged accounts cannot reach sensitive components. Review audit logs for anomalous activity by low-privilege accounts against ECC for Award and IDV functionality.