CVE-2026-87150: Oracle Bills of Material Privilege Escalation

CVE-2026-87150 Overview

CVE-2026-87150 affects the Oracle Bills of Material product within Oracle E-Business Suite, specifically the Setup Workbench component. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access via HTTP can exploit this flaw to fully compromise Oracle Bills of Material. Successful exploitation results in complete takeover of the product, impacting confidentiality, integrity, and availability. The weakness is classified under Improper Privilege Management [CWE-269].

Critical Impact
A low-privileged, authenticated attacker can escalate access over the network and take over Oracle Bills of Material, compromising business-critical manufacturing and product data.

Affected Products

Oracle E-Business Suite — Oracle Bills of Material 12.2.3
Oracle E-Business Suite — Oracle Bills of Material 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Bills of Material 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87150 published to the National Vulnerability Database (NVD)
2026-09-15 - Oracle publishes the Oracle Security Alert September 2026
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87150

Vulnerability Analysis

The vulnerability resides in the Setup Workbench component of Oracle Bills of Material, part of Oracle E-Business Suite (EBS). Oracle Bills of Material manages engineering and manufacturing bill-of-material data used across production planning, costing, and order management.

An attacker who already holds a low-privileged account on the EBS instance can send crafted HTTP requests to Setup Workbench endpoints. The application fails to enforce appropriate privilege boundaries, allowing the attacker to perform operations reserved for higher-privileged users. Exploitation does not require user interaction and does not cross a security scope boundary.

Because Bills of Material integrates with modules such as Inventory, Cost Management, and Work in Process, a takeover of the module can expose product structures, routing data, and cost information across the ERP footprint.

Root Cause

The root cause is improper privilege management [CWE-269] in the Setup Workbench component. Authorization checks are insufficient for actions exposed to authenticated users. Server-side logic trusts the caller's session for sensitive setup operations rather than reevaluating entitlement per action.

Attack Vector

Exploitation requires network access to the HTTP interface of Oracle E-Business Suite and a valid low-privileged account. No user interaction is needed. An attacker who already has any authenticated foothold in the EBS environment, whether a business user or a compromised service account, can reach the vulnerable Setup Workbench endpoints and drive privilege escalation to full compromise of Oracle Bills of Material.

No public exploit or proof-of-concept has been published. Refer to the Oracle Security Alert September 2026 for vendor technical details.

Detection Methods for CVE-2026-87150

Indicators of Compromise

Unexpected HTTP requests from low-privileged EBS users to Bills of Material Setup Workbench URLs and servlets.
Unusual creation or modification of bills of material, item structures, or workbench configuration records outside normal change windows.
New or modified responsibilities, menus, or function assignments granting elevated Bills of Material access.
Authenticated session activity from geographies or hosts inconsistent with the account's normal usage.

Detection Strategies

Audit FND_LOGINS, FND_LOGIN_RESPONSIBILITIES, and Bills of Material application tables for privilege changes correlated with Setup Workbench access.
Deploy Web Application Firewall (WAF) rules to log and inspect HTTP traffic to Setup Workbench endpoints, focusing on parameter tampering and privileged action calls.
Correlate EBS application logs with identity provider logs to identify low-privileged accounts performing setup-level operations.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking on Bills of Material responsibilities.
Forward EBS middle-tier and database audit logs to a central SIEM for behavioral analysis of privilege changes.
Alert on any authenticated user invoking Setup Workbench functions that do not match their assigned responsibility set.

How to Mitigate CVE-2026-87150

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert September 2026 to all affected Oracle E-Business Suite 12.2.3 through 12.2.15 instances.
Inventory all EBS environments, including non-production, and confirm Oracle Bills of Material patch levels.
Review and reduce low-privileged accounts with any access to Bills of Material responsibilities.
Rotate credentials for accounts that could have reached the Setup Workbench prior to patching.

Patch Information

Oracle addressed CVE-2026-87150 as part of the Oracle Security Alert September 2026. Administrators should download the corresponding patch for Oracle E-Business Suite 12.2 from My Oracle Support and apply it following Oracle's documented EBS patching procedure. Restart the middle tier and validate Bills of Material functionality after installation. Consult the Oracle Security Alert September 2026 for exact patch identifiers.

Workarounds

Restrict network access to the EBS HTTP tier using firewall rules, VPN gating, or reverse-proxy allowlists until patches are deployed.
Temporarily remove Bills of Material Setup Workbench responsibilities from non-essential users.
Enforce multi-factor authentication (MFA) on all EBS accounts to raise the cost of low-privileged account compromise.
Enable enhanced auditing on Bills of Material tables and Setup Workbench functions to detect exploitation attempts.

bash

# Example: restrict access to the EBS HTTP tier at the network edge
# Allow only trusted corporate ranges to reach the Oracle EBS front end
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP

# Example: enable Sign-On Audit at the FORM level in Oracle EBS
# Set profile option 'Sign-On:Audit Level' = FORM at site level
# via System Administrator responsibility