CVE-2026-87162: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-87162 Overview

CVE-2026-87162 is a privilege escalation vulnerability in the Oracle Contract Lifecycle Management for Public Sector product, part of Oracle E-Business Suite. The flaw resides in the Award/PO component and affects supported versions 12.2.13 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the issue to fully compromise the application. Successful exploitation can result in complete takeover of Oracle Contract Lifecycle Management for Public Sector, impacting confidentiality, integrity, and availability. The vulnerability is tracked under CWE-269: Improper Privilege Management.

Critical Impact
An authenticated attacker with minimal privileges can take over the Oracle Contract Lifecycle Management for Public Sector instance and access or modify contract, procurement, and award data.

Affected Products

Oracle E-Business Suite – Oracle Contract Lifecycle Management for Public Sector, version 12.2.13
Oracle E-Business Suite – Oracle Contract Lifecycle Management for Public Sector, version 12.2.14
Oracle E-Business Suite – Oracle Contract Lifecycle Management for Public Sector, version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87162 published to NVD
2026-09-17 - Last updated in NVD database
Reference - Oracle Security Alert CSPUSEP2026

Technical Details for CVE-2026-87162

Vulnerability Analysis

The vulnerability affects the Award/PO component of Oracle Contract Lifecycle Management for Public Sector, a module used by government and defense agencies to manage procurement contracts and awards. The flaw is categorized as improper privilege management [CWE-269], meaning the application fails to correctly enforce authorization boundaries between users of differing privilege levels.

A user holding only low-level application access can invoke functionality reserved for higher-privileged roles. Because the attack traverses HTTP and requires no user interaction, exploitation can be automated against exposed E-Business Suite deployments. The impact extends across confidentiality, integrity, and availability, consistent with full application takeover.

Root Cause

The root cause is insufficient privilege enforcement in the Award/PO component. Server-side authorization checks either omit sensitive operations or accept client-supplied context that grants elevated capabilities. Oracle has not released a public technical breakdown; the details are enumerated in the vendor security alert.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP endpoint and any low-privileged application account. The attacker sends crafted HTTP requests to Award/PO functionality, invoking operations that should be restricted to privileged users. No user interaction is required, and the attack completes within the vulnerable component's security scope.

No public proof-of-concept or exploit code is available at the time of writing. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-87162

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts targeting Award/PO endpoints within the Oracle E-Business Suite Contract Lifecycle Management module.
Creation, modification, or approval of contracts and purchase orders by accounts that do not normally hold procurement authority.
Audit log entries showing privilege elevation, role assignment changes, or bulk data reads originating from non-administrative sessions.

Detection Strategies

Correlate application-tier audit logs with web server access logs to identify sessions that transition from low-privilege actions to privileged Award/PO operations.
Baseline normal procurement workflow behavior and alert on out-of-pattern approvals, award adjustments, or contract exports.
Monitor Oracle E-Business Suite FND user session tables for anomalous responsibility switches tied to procurement modules.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Contract Lifecycle Management responsibilities.
Forward Oracle HTTP Server and application logs to a centralized analytics platform for retention and correlation.
Alert on repeated HTTP 4xx/5xx responses against Award/PO URLs, which may indicate exploitation attempts or reconnaissance.

How to Mitigate CVE-2026-87162

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all instances running versions 12.2.13 through 12.2.15.
Restrict network access to the Oracle E-Business Suite HTTP tier so that only trusted networks and identity-aware proxies can reach Award/PO endpoints.
Review recent activity on procurement responsibilities and revoke sessions or accounts that show anomalous behavior.

Patch Information

Oracle addressed CVE-2026-87162 in the Oracle Security Alert CSPUSEP2026 released on 2026-09-15. Administrators should download and apply the corresponding patch for Oracle E-Business Suite 12.2.13, 12.2.14, and 12.2.15 from My Oracle Support. Full remediation details are documented in the Oracle Security Alert CSPUSEP2026.

Workarounds

Limit the assignment of Contract Lifecycle Management responsibilities to essential users until patching is complete.
Place the E-Business Suite frontend behind a web application firewall with rules that inspect and rate-limit Award/PO requests from low-privileged sessions.
Enforce multi-factor authentication and strong password policies on E-Business Suite application accounts to reduce the pool of usable low-privilege credentials.

bash

# Configuration example: restrict Award/PO paths at the reverse proxy
# (Apache HTTP Server example; adapt to your environment)
<LocationMatch "^/OA_HTML/.*(Award|PO).*">
    Require ip 10.0.0.0/8 192.168.0.0/16
    # Deny direct internet access; force traffic through authenticated proxy
</LocationMatch>