CVE-2026-87165: Oracle E-Business Suite Privilege Escalation

CVE-2026-87165 Overview

CVE-2026-87165 is a privilege management vulnerability in the Oracle Contract Lifecycle Management for Public Sector (CLMPS) product, part of Oracle E-Business Suite. The flaw resides in the ECC For Award and IDV component of version V16. A low-privileged attacker with network access over HTTP can exploit the issue without user interaction. Successful exploitation results in full takeover of the Oracle Contract Lifecycle Management for Public Sector application, impacting confidentiality, integrity, and availability. The weakness is classified under CWE-269: Improper Privilege Management.

Critical Impact
An authenticated attacker with minimal privileges can escalate to full control of the CLMPS application, exposing sensitive public sector contract data and enabling manipulation of award and Indefinite Delivery Vehicle (IDV) records.

Affected Products

Oracle E-Business Suite
Oracle Contract Lifecycle Management for Public Sector
Version V16 (ECC For Award and IDV component)

Discovery Timeline

2026-09-15 - CVE-2026-87165 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87165

Vulnerability Analysis

The vulnerability affects the Enterprise Command Center (ECC) module servicing Award and Indefinite Delivery Vehicle (IDV) functions inside Oracle Contract Lifecycle Management for Public Sector. Oracle's advisory categorizes the attack surface as network-reachable HTTP endpoints requiring only low-tier authenticated access. An attacker leveraging any valid low-privilege account can compromise the entire application context.

Given the CWE-269 classification, the flaw stems from improper enforcement of privilege boundaries within contract award and IDV workflows. This enables an authorized user to perform actions reserved for higher-privileged roles, culminating in application takeover. Oracle E-Business Suite deployments in federal, state, and local government environments frequently host sensitive procurement data, making this vulnerability particularly impactful for public sector tenants.

Root Cause

The root cause is improper privilege management [CWE-269] within the ECC For Award and IDV component. Access control checks fail to validate whether the requesting user holds the necessary role for privileged operations. As a result, low-privilege sessions can invoke administrative-tier functionality that should be gated by stricter authorization logic.

Attack Vector

Exploitation requires HTTP access to the Oracle E-Business Suite instance and valid low-privilege credentials. No user interaction is required, and attack complexity is low. An attacker sends crafted HTTP requests to the affected ECC endpoints handling Award and IDV data. Because the scope remains unchanged and impacts are high across confidentiality, integrity, and availability, a successful request yields complete control of the CLMPS application.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Oracle has not published sanitized exploitation details. Refer to the Oracle Security Alert CSPUSEP2026 for the authoritative advisory.

Detection Methods for CVE-2026-87165

Indicators of Compromise

Unexpected privileged operations on Award or IDV records originating from accounts with only baseline CLMPS roles.
HTTP request patterns targeting ECC endpoints outside of a user's normal workflow or role assignment.
Unusual creation, modification, or deletion of contract awards and IDV entries outside change-window activity.

Detection Strategies

Audit Oracle E-Business Suite FND_LOGIN and application audit tables for privilege escalations tied to low-tier accounts.
Correlate web tier access logs against user role assignments to identify requests that exceed granted privileges.
Enable and review Oracle E-Business Suite Signed Auditing on the Award and IDV tables to capture unauthorized changes.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web tier logs to a centralized analytics platform for correlation.
Baseline normal Award and IDV transaction volumes per user role and alert on statistical deviations.
Monitor administrative role assignments and responsibility grants for unexpected changes following authentication events from low-privilege accounts.

How to Mitigate CVE-2026-87165

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert CSPUSEP2026 to all affected V16 deployments.
Inventory every Oracle E-Business Suite instance running Contract Lifecycle Management for Public Sector and confirm patch status.
Review recent activity in Award and IDV records for unauthorized modifications made prior to patching.
Rotate credentials for low-privilege accounts that had network access to the CLMPS interface during the exposure window.

Patch Information

Oracle released fixes for CVE-2026-87165 in Security Alert CSPUSEP2026. The advisory covers Oracle Contract Lifecycle Management for Public Sector V16 and the ECC For Award and IDV component. Oracle recommends applying the patch without delay because the flaw is easily exploitable. Consult the Oracle Security Alert CSPUSEP2026 for the patch bundle, prerequisites, and post-installation validation steps.

Workarounds

Restrict network access to Oracle E-Business Suite HTTP endpoints to trusted management networks and authenticated VPN users only.
Enforce least-privilege responsibility assignments in Oracle E-Business Suite until the patch is applied.
Temporarily disable or restrict access to the ECC For Award and IDV component if operationally feasible.
Increase audit logging retention and review frequency for CLMPS transactions during the interim exposure period.