CVE-2026-87151: Oracle Bills of Material Data Disclosure Flaw

CVE-2026-87151 Overview

CVE-2026-87151 affects the Oracle Bills of Material product within Oracle E-Business Suite, specifically the Setup Workbench component. The flaw impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to gain unauthorized read access to all data accessible through Oracle Bills of Material. The vulnerability includes a scope change, meaning successful exploitation can affect components beyond Oracle Bills of Material itself. Oracle addressed the issue in Security Alert CSPUSEP2026.

Critical Impact
An authenticated attacker can extract confidential business data across the E-Business Suite deployment through HTTP requests to the Setup Workbench, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle E-Business Suite - Oracle Bills of Material 12.2.3
Oracle E-Business Suite - Oracle Bills of Material 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Bills of Material 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87151 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87151

Vulnerability Analysis

The vulnerability resides in the Setup Workbench component of Oracle Bills of Material, a manufacturing module of Oracle E-Business Suite used to define product structures and manufacturing routings. An authenticated attacker with limited application privileges can send crafted HTTP requests to the Setup Workbench and retrieve confidential data that should be restricted. Because the vulnerability produces a scope change, the impact extends to data owned by other Oracle E-Business Suite components accessible through the same trust boundary. The confidentiality-only impact indicates the flaw exposes information without altering records or degrading availability.

Root Cause

Oracle has not published root-cause details in the public advisory. The CVSS metrics indicate an authorization-related weakness in the Setup Workbench that permits low-privileged users to reach data belonging to a broader security scope. Consult Oracle Security Alert CSPUSEP2026 for vendor-supplied technical detail available to customers with support access.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP endpoint and valid low-privileged credentials. No user interaction is required, and attack complexity is low. An attacker authenticates to the application, then issues crafted HTTP requests targeting the Setup Workbench module to read protected data. The absence of a public proof-of-concept and an EPSS score of 0.371% indicate limited public exploitation activity at this time.

No verified exploit code is publicly available. Refer to the Oracle Security Alert for technical specifics accessible under support entitlement.

Detection Methods for CVE-2026-87151

Indicators of Compromise

Unusual volume of HTTP requests from low-privileged Oracle E-Business Suite accounts targeting Setup Workbench URLs under the Oracle Bills of Material module.
Access to Setup Workbench pages by user accounts that do not have a legitimate manufacturing engineering role.
Application audit log entries showing data reads spanning multiple product structures or organizations in short time windows.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to capture navigation to Bills of Material Setup Workbench pages.
Correlate application session identifiers with HTTP access logs on the Oracle HTTP Server tier to identify anomalous request patterns.
Baseline normal Setup Workbench usage per responsibility, then alert on deviations by user, source IP, or request rate.

Monitoring Recommendations

Forward Oracle E-Business Suite audit tables, FND_LOGINS, and web tier access logs to a centralized SIEM for retention and correlation.
Alert on authenticated sessions that suddenly access Bills of Material data outside their historical responsibility scope.
Monitor for post-exploitation indicators such as bulk export activity or downstream queries to sensitive product and cost data.

How to Mitigate CVE-2026-87151

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUSEP2026 to all affected Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory user accounts with access to Oracle Bills of Material responsibilities and confirm each account requires the assigned privileges.
Restrict network reachability of the Oracle E-Business Suite HTTP endpoint to trusted corporate networks and VPN ranges.
Rotate credentials for any low-privileged accounts suspected of unauthorized use pending patch deployment.

Patch Information

Oracle published the fix in Security Alert CSPUSEP2026. Customers should download the applicable patch for Oracle E-Business Suite 12.2 from My Oracle Support and apply it following Oracle's documented patching procedures for the E-Business Suite technology stack. Test the patch in a non-production environment before promoting it to production.

Workarounds

Temporarily remove the Bills of Material Setup Workbench function from responsibilities assigned to non-essential users until patching completes.
Place a web application firewall in front of the Oracle HTTP Server tier and block anomalous request patterns targeting Setup Workbench pages.
Increase audit logging verbosity on Oracle Bills of Material forms and pages to accelerate detection while the patch is pending.

bash

# Configuration example
# Refer to Oracle Security Alert CSPUSEP2026 for the authoritative patch identifiers
# and apply using adop in Oracle E-Business Suite 12.2:
# adop phase=apply patches=<PATCH_NUMBER> workers=<N>