CVE-2026-87265

CVE-2026-87265 is an improper authorization flaw in the Oracle Purchasing module of Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. A low-privileged attacker with a valid account and network access via HTTP can exploit the flaw easily, without user interaction, to compromise Oracle Purchasing. A successful attack yields unauthorized creation, deletion, or modification of critical Purchasing data — or all Oracle Purchasing-accessible data — as well as unauthorized read access up to complete exposure of that data (high confidentiality and integrity impact, CVSS 8.1). Organizations running affected EBS 12.2.x releases with Purchasing exposed to authenticated users, especially internet-facing self-service deployments, are at risk. The flaw is not in the CISA KEV catalog, no public PoC is known, and no exploitation in the wild has been reported.

What to do: Apply the Oracle Critical Patch Update that remediates this CVE to all EBS environments on 12.2.3–12.2.15. Restrict HTTP access to EBS via network segmentation or VPN so that only trusted, authenticated users can reach the Purchasing module, and enforce least privilege on responsibilities that grant Purchasing access. Review audit trails for recent purchase orders, requisitions, and supplier records to detect any unauthorized creation, modification, or deletion.