CVE-2026-87127: Oracle E-Business Suite Information Disclosure

CVE-2026-87127 Overview

CVE-2026-87127 is a high-severity information disclosure vulnerability in the Oracle Purchasing product of Oracle E-Business Suite, specifically within the G-Invoicing component. Affected releases include supported versions 12.2.10 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the flaw to gain unauthorized access to critical Oracle Purchasing data. The vulnerability carries a scope change, meaning successful exploitation may impact components beyond Oracle Purchasing itself. Oracle addressed the issue in Security Alert CSPUSEP2026.

Critical Impact
An authenticated attacker with minimal privileges can remotely compromise confidentiality across Oracle Purchasing and adjacent products through the G-Invoicing component over HTTP.

Affected Products

Oracle E-Business Suite — Oracle Purchasing 12.2.10
Oracle E-Business Suite — Oracle Purchasing 12.2.11 through 12.2.14
Oracle E-Business Suite — Oracle Purchasing 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87127 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87127

Vulnerability Analysis

The vulnerability resides in the G-Invoicing component of Oracle Purchasing within Oracle E-Business Suite. G-Invoicing supports federal intragovernmental buy/sell transactions and processes HTTP-borne requests through the E-Business Suite web tier. An authenticated attacker with low privileges can craft requests that bypass intended access restrictions and read sensitive purchasing data.

The scope change property indicates that the security boundary compromised by the attack differs from the boundary containing the vulnerable code. In practice, exploitation of Oracle Purchasing can leak data belonging to other Oracle E-Business Suite modules that share the same runtime or data tier.

The flaw affects confidentiality only. Integrity and availability of the target system are not directly impacted, but exposed data may include procurement records, supplier information, and financial transaction details tied to federal invoicing workflows.

Root Cause

Oracle has not published a detailed root cause. Based on the CVSS profile, the defect is consistent with a broken access control or authorization bypass in the G-Invoicing HTTP endpoints that allows an authenticated user to read data outside the intended authorization boundary. Refer to Oracle Security Alert CSPUSEP2026 for vendor-provided details.

Attack Vector

Exploitation requires network access to the E-Business Suite web tier over HTTP and a valid low-privileged application account. No user interaction is required. The attacker issues crafted HTTP requests to G-Invoicing endpoints exposed by Oracle Purchasing to retrieve data the account should not be able to access. Because the attack complexity is low and privileges required are minimal, environments exposing E-Business Suite to broad user populations or partner networks are at elevated risk.

No public proof-of-concept exploit is available at publication time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-87127

Indicators of Compromise

Unexpected HTTP requests to G-Invoicing URLs under the Oracle Purchasing module originating from low-privileged user sessions.
Anomalous volumes of read operations against purchasing or invoicing tables tied to a single application session.
Access to G-Invoicing endpoints from user accounts with no legitimate business need for federal invoicing workflows.

Detection Strategies

Review Oracle E-Business Suite access logs and Apache/OHS web tier logs for unusual request patterns targeting G-Invoicing servlets and JSPs.
Correlate application-level audit records with database session activity to identify authenticated users retrieving data outside their assigned responsibilities.
Establish baselines for normal G-Invoicing usage and alert on statistically significant deviations in request volume, response size, or endpoint diversity.

Monitoring Recommendations

Forward E-Business Suite web tier, concurrent manager, and database audit logs to a centralized analytics platform for continuous monitoring.
Enable Oracle Fine-Grained Auditing (FGA) on sensitive purchasing and invoicing tables to record read access by user and session.
Track privilege assignments and responsibility changes affecting the Purchasing and G-Invoicing menus.

How to Mitigate CVE-2026-87127

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all Oracle E-Business Suite 12.2.10 through 12.2.15 environments.
Inventory all internet-exposed E-Business Suite instances and prioritize patching those reachable from untrusted networks.
Audit user accounts and responsibilities granting access to Oracle Purchasing and G-Invoicing, and remove unnecessary assignments.

Patch Information

Oracle released remediation for CVE-2026-87127 as part of Security Alert CSPUSEP2026. Administrators should review the alert, identify the applicable patch for their exact E-Business Suite release, and apply it through standard adop patching procedures. See Oracle Security Alert CSPUSEP2026 for patch identifiers and installation guidance.

Workarounds

Restrict network access to the E-Business Suite web tier using firewalls, reverse proxies, or VPNs so that only authorized users can reach G-Invoicing endpoints.
Disable or restrict the G-Invoicing menu and function access for user responsibilities that do not require federal invoicing capabilities.
Enforce strong authentication and session controls on all E-Business Suite accounts to reduce the pool of low-privileged users who could exploit the flaw.

bash

# Example: apply an E-Business Suite 12.2 patch using adop
# Replace <PATCH_NUMBER> with the identifier from Oracle Security Alert CSPUSEP2026
source $APPL_TOP/APPS<CONTEXT_NAME>.env
adop phase=prepare
adop phase=apply patches=<PATCH_NUMBER> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup