CVE-2026-87158: Oracle Order Management Auth Bypass Flaw

CVE-2026-87158 Overview

CVE-2026-87158 affects the Enterprise Command Center component of Oracle Order Management, part of Oracle E-Business Suite version V16. A low-privileged attacker with network access over HTTP can exploit this flaw without user interaction. Successful exploitation grants unauthorized access to critical data across Oracle Order Management and permits unauthorized update, insert, or delete operations on a subset of that data. Oracle disclosed the issue in Security Alert CSPUSEP2026.

Critical Impact
An authenticated attacker with minimal privileges can read all Oracle Order Management data and modify a subset of records over the network via HTTP.

Affected Products

Oracle E-Business Suite
Oracle Order Management
Enterprise Command Center component (version V16)

Discovery Timeline

2026-09-15 - CVE-2026-87158 published to the National Vulnerability Database
2026-09-16 - Entry last modified in NVD

Technical Details for CVE-2026-87158

Vulnerability Analysis

The vulnerability resides in the Enterprise Command Center (ECC) component used by Oracle Order Management within Oracle E-Business Suite V16. Oracle's advisory classifies the flaw as easily exploitable over HTTP by an attacker holding valid low-privileged credentials. Exploitation yields high confidentiality impact and low integrity impact, with no direct impact on availability.

The scope remains unchanged, meaning the compromised component and the impacted resources share the same security authority. In practical terms, an authenticated user of the E-Business Suite can retrieve records they were never authorized to view and can also tamper with a portion of Order Management data.

Root Cause

Oracle has not published root cause details in the public advisory. The described impact profile — broad read access plus limited write access from a low-privileged account — is consistent with a broken access control or authorization bypass defect within the Enterprise Command Center dashboards or search interfaces that expose Order Management data.

Attack Vector

The attack vector is network-based (AV:N) over HTTP. An attacker requires a valid account within the E-Business Suite environment but does not need elevated roles. No user interaction is needed to trigger the flaw. Because the Enterprise Command Center is typically reachable to any authenticated E-Business Suite user, the attack surface includes any internal or externally exposed EBS deployment.

No public proof-of-concept exploit is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of publication. The EPSS probability is 0.316%.

See the Oracle Security Alert CSPUSEP2026 for vendor technical details.

Detection Methods for CVE-2026-87158

Indicators of Compromise

Unexpected HTTP requests from low-privileged E-Business Suite accounts to Enterprise Command Center endpoints associated with Order Management dashboards.
Anomalous volumes of data retrieval or export activity from ECC search and drill-down interfaces.
Unauthorized UPDATE, INSERT, or DELETE operations against Oracle Order Management tables initiated through ECC session contexts.

Detection Strategies

Correlate application-tier HTTP access logs with database audit trails to identify low-privileged users returning data outside their role scope.
Baseline typical ECC query behavior per user role and alert on deviations in query breadth, result volume, or record modification rates.
Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Order Management responsibility to record ECC page usage.

Monitoring Recommendations

Forward Oracle E-Business Suite application logs, Apache/OHS access logs, and database audit logs to a centralized analytics platform for cross-source correlation.
Alert on HTTP 200 responses to ECC endpoints paired with SQL activity that references Order Management objects outside the caller's authorized organization or operating unit.
Review privileged and service account activity daily until the patch is confirmed applied across all EBS nodes.

How to Mitigate CVE-2026-87158

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all Oracle E-Business Suite V16 environments running the Enterprise Command Center for Order Management.
Inventory all EBS instances exposed to internal and external networks and prioritize internet-facing systems for patching first.
Audit recent access logs and database activity for signs of unauthorized data retrieval or modification against Order Management objects.

Patch Information

Oracle addressed the vulnerability in the out-of-cycle Security Alert CSPUSEP2026. Administrators should download the applicable patch from My Oracle Support and apply it following the instructions in the Oracle Security Alert CSPUSEP2026 advisory. Validate patch deployment on all application tier and middle tier nodes.

Workarounds

Restrict network access to Enterprise Command Center URLs using web application firewall rules or reverse proxy access lists until patching completes.
Temporarily remove the Order Management ECC responsibility from users who do not require it as part of their job function.
Enforce multi-factor authentication for all E-Business Suite accounts to reduce the value of credentials that could be used to exploit the flaw.

bash

# Example: restrict ECC endpoints at the reverse proxy until patching is complete
# Replace <ecc-path> with the deployed Enterprise Command Center context root
<Location /<ecc-path>/>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>