CVE-2026-87157: Oracle Order Management Auth Bypass Flaw

CVE-2026-87157 Overview

CVE-2026-87157 is a high-severity vulnerability in the Oracle Order Management product of Oracle E-Business Suite, specifically within the Product Diagnostic Tools component. Supported versions 12.2.4 through 12.2.15 are affected. The flaw is easily exploitable over HTTP by a low-privileged attacker with network access. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle Order Management accessible data. Oracle published the fix in its September 2026 Critical Patch Update Security Advisory.

Critical Impact
Authenticated attackers can read and modify all data accessible to Oracle Order Management over the network, compromising order records, pricing data, and customer transaction integrity.

Affected Products

Oracle E-Business Suite — Oracle Order Management, version 12.2.4
Oracle E-Business Suite — Oracle Order Management, versions 12.2.5 through 12.2.14
Oracle E-Business Suite — Oracle Order Management, version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87157 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87157

Vulnerability Analysis

The vulnerability resides in the Product Diagnostic Tools component of Oracle Order Management, part of the broader Oracle E-Business Suite. An attacker with low-level authenticated access can send crafted HTTP requests over the network to interact with diagnostic functionality that lacks adequate access enforcement. The scope remains unchanged, meaning the impact is confined to the vulnerable component, but within that boundary the attacker gains high confidentiality and integrity impact. Availability is not affected. Oracle rates the flaw as network-exploitable with low attack complexity and no user interaction required.

Root Cause

Oracle's advisory does not disclose the underlying flaw class. Based on the CVSS metrics and the affected component, the root cause is consistent with a Broken Access Control or Authorization Bypass condition in the Product Diagnostic Tools endpoint, permitting a low-privileged user to invoke functions that should be restricted to administrators. Refer to the Oracle Security Advisory for authoritative technical details.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP interface and valid low-privileged credentials. No user interaction is needed. The attacker issues HTTP requests targeting the Product Diagnostic Tools functionality inside Oracle Order Management. Successful requests yield read and write access to Order Management data, including order lines, pricing, customer references, and other objects accessible to that module.

No public proof-of-concept code is available. The current EPSS probability is 0.392%. See the Oracle Critical Patch Update advisory for patch and configuration guidance.

Detection Methods for CVE-2026-87157

Indicators of Compromise

Unexpected HTTP requests from low-privileged Oracle E-Business Suite accounts to Product Diagnostic Tools URIs under the Order Management module.
Anomalous read or write operations against Order Management tables originating from application-tier sessions tied to non-administrative users.
Diagnostic tool invocations occurring outside change-management windows or from unusual source IP ranges.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to identify unauthorized access to diagnostic pages.
Correlate application-tier HTTP access logs with database audit logs to detect low-privileged users triggering diagnostic operations that modify Order Management data.
Baseline normal Product Diagnostic Tools usage patterns and alert on deviations in user, frequency, or affected records.

Monitoring Recommendations

Forward Oracle E-Business Suite application, Apache, and Concurrent Manager logs to a centralized SIEM for correlation and long-term retention.
Monitor authentication events for low-privileged accounts that suddenly access diagnostic or administrative URLs.
Alert on SQL statements executed by the APPS schema that originate from diagnostic tool sessions and modify order, pricing, or customer records.

How to Mitigate CVE-2026-87157

Immediate Actions Required

Apply the September 2026 Oracle Critical Patch Update for Oracle E-Business Suite 12.2 as soon as maintenance windows allow.
Inventory all Oracle E-Business Suite environments running Order Management versions 12.2.4 through 12.2.15 and prioritize internet-exposed instances.
Rotate credentials for accounts that may have been used to access the Product Diagnostic Tools if any suspicious activity is identified.
Restrict network access to the Oracle E-Business Suite HTTP tier to trusted networks and VPN users only.

Patch Information

Oracle addressed CVE-2026-87157 in its September 2026 Critical Patch Update. Administrators must download and apply the patches referenced in the Oracle Security Advisory for Oracle E-Business Suite 12.2. Oracle does not typically release backports for unsupported patch levels, so environments must be on a supported 12.2.x baseline before patching.

Workarounds

Restrict access to Product Diagnostic Tools by revoking the associated responsibilities and menus from non-administrative users using Oracle E-Business Suite's Function and Menu security.
Place a web application firewall or reverse proxy in front of the Oracle E-Business Suite HTTP tier to block requests to diagnostic URIs from untrusted sources.
Enforce network segmentation so that the E-Business Suite application tier is not reachable from the public internet or general corporate user networks.

bash

# Configuration example: revoke diagnostic tool access from a responsibility
# Run within Oracle E-Business Suite as a System Administrator
# Navigate: System Administrator > Security > Responsibility > Define
#   1. Query the target responsibility
#   2. Under Menu Exclusions, add the Product Diagnostic Tools menu
#   3. Save and re-test access with a low-privileged user