CVE-2026-87166

CVE-2026-87166 is a high-severity (CVSS 3.1 base 8.1) vulnerability in the Oracle Purchasing product of Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit it easily, using a valid low-level account to compromise Oracle Purchasing. Successful attacks allow unauthorized creation, deletion, or modification of critical Purchasing data, as well as unauthorized read access to critical data or all Oracle Purchasing-accessible data; availability is not impacted per the CVSS vector (C:H/I:H/A:N). Any organization running E-Business Suite 12.2 with the Oracle Purchasing module reachable over HTTP by internal or external users is affected. No public proof of concept is known and the flaw is not in the CISA KEV catalog, but it was addressed in Oracle's April 2026 Critical Patch Update.

What to do: Apply the Oracle Critical Patch Update (April 2026) that remediates this flaw to all E-Business Suite 12.2.3–12.2.15 environments running Oracle Purchasing, as EBS security patches are cumulative within the 12.2 codeline. Restrict HTTP reachability to EBS so only authenticated, authorized users on trusted networks or VPN can access it. Review Purchasing audit logs for unexpected data creation, modification, deletion, or read activity by low-privilege accounts.