CVE-2026-87149: Oracle CLM Authentication Bypass Vulnerability

CVE-2026-87149 Overview

CVE-2026-87149 is a vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite, within the Award/PO component. Affected versions span 12.2.8 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the flaw to compromise the application. Successful exploitation grants unauthorized read access to all data accessible by the product, along with unauthorized update, insert, or delete access to a subset of that data. Oracle addressed the issue in Security Alert CSPUSEP2026.

Critical Impact
An authenticated attacker with minimal privileges can read all data accessible to Oracle Contract Lifecycle Management for Public Sector and modify a portion of it over the network.

Affected Products

Oracle E-Business Suite — Contract Lifecycle Management for Public Sector, version 12.2.8
Oracle E-Business Suite — Contract Lifecycle Management for Public Sector, versions 12.2.9 through 12.2.14
Oracle E-Business Suite — Contract Lifecycle Management for Public Sector, version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87149 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87149

Vulnerability Analysis

The vulnerability resides in the Award/PO component of Oracle Contract Lifecycle Management for Public Sector, part of Oracle E-Business Suite. The component handles procurement award and purchase order workflows for public sector contracting. An authenticated user with low privileges can send crafted HTTP requests that bypass intended data access boundaries. Oracle characterizes the flaw as easily exploitable, meaning it does not require complex preconditions or user interaction.

Successful exploitation yields high confidentiality impact and low integrity impact. The attacker gains full visibility into data accessible to the product and can perform limited unauthorized writes. Availability is not affected. The scope remains unchanged, so impact is confined to the vulnerable application context rather than pivoting into other components.

Root Cause

Oracle has not published detailed root cause information in the public advisory. The impact profile — broad confidentiality loss combined with limited write access from an authenticated low-privilege session — is consistent with a broken access control or authorization flaw in the Award/PO request handlers. See the Oracle Security Alert CSPUSEP2026 for vendor-provided details.

Attack Vector

Exploitation occurs over the network via HTTP against the E-Business Suite front end. The attacker must hold a valid low-privileged account on the target application. No user interaction is required. Because Oracle E-Business Suite deployments frequently expose the middle tier to internal users and, in some configurations, business partners, the pool of potential attackers can be substantial in real environments.

Detection Methods for CVE-2026-87149

Indicators of Compromise

Unexpected HTTP requests to Award/PO endpoints from low-privileged Oracle E-Business Suite user accounts.
Access to contract, award, or purchase order records that fall outside a user's assigned responsibilities or organizational scope.
Anomalous SELECT, UPDATE, INSERT, or DELETE activity in Oracle CLM tables originating from application service accounts during atypical hours.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and page access tracking to record which users invoke Award/PO functions and correlate against assigned responsibilities.
Review Oracle database audit logs for CLM schema objects to identify bulk reads or writes inconsistent with role definitions.
Correlate web tier access logs with authenticated user session data to flag privilege boundary violations.

Monitoring Recommendations

Ingest E-Business Suite application, web tier, and database audit logs into a centralized analytics platform for cross-source correlation.
Establish a behavioral baseline for CLM Award/PO usage per role and alert on statistical deviations.
Monitor Oracle's advisory channels for updates to CSPUSEP2026 and related quarterly Critical Patch Updates.

How to Mitigate CVE-2026-87149

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUSEP2026 for all affected 12.2.8–12.2.15 deployments.
Inventory Oracle E-Business Suite environments and confirm which instances have the Contract Lifecycle Management for Public Sector module enabled.
Restrict network reachability of the E-Business Suite middle tier to trusted user populations while patching is scheduled.
Review and tighten responsibility assignments for low-privileged users who can reach Award/PO functionality.

Patch Information

Oracle released fixes as part of Security Alert CSPUSEP2026. Administrators should identify the applicable patch for their exact release level within the 12.2.8–12.2.15 range, stage it in a non-production environment, and validate business processes before promoting to production. Consult My Oracle Support for prerequisite technology stack updates.

Workarounds

Temporarily revoke Award/PO menu access from low-privileged responsibilities that do not require it.
Restrict HTTP access to Contract Lifecycle Management for Public Sector URLs via web application firewall or reverse proxy rules until patches are deployed.
Increase database and application audit verbosity on CLM objects to shorten detection time for exploitation attempts.

bash

# Configuration example: after patching, verify the applied fix inventory
adop -status
opatch lsinventory | grep -i cspusep2026