CVE-2026-87167

Oracle E-Business Suite's Oracle Purchasing product contains an easily exploitable flaw in its G-Invoicing component, affecting supported versions 12.2.11 through 12.2.15. A low-privileged attacker with network access via HTTP can trigger the flaw without any user interaction, requiring only minimal privileges on the target system. Successful exploitation lets the attacker create, delete, or modify critical data — or all Oracle Purchasing-accessible data — as well as gain unauthorized access to sensitive purchasing records. The vulnerability carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impacts, though availability is unaffected. No public proof of concept exists and the issue is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation is not currently observed.

What to do: Apply the Oracle Critical Patch Update that remediates this issue to all EBS 12.2.11-12.2.15 environments running G-Invoicing, as no workaround is indicated. Restrict HTTP access to the EBS application tier to trusted networks and enforce least-privilege role assignments, since exploitation requires only a low-privileged account. Review purchasing and G-Invoicing audit logs for unauthorized data creation, modification, or deletion and monitor low-privilege accounts for anomalous activity.