CVE-2026-87166 Overview
CVE-2026-87166 is a high-severity vulnerability in the Oracle Purchasing product of Oracle E-Business Suite. The flaw resides in an unspecified component of the Purchasing module and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Purchasing. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all Oracle Purchasing accessible data. The vulnerability was disclosed in Oracle Security Alert CSPUSEP2026.
Critical Impact
Authenticated attackers can read, modify, or destroy all data accessible through Oracle Purchasing over HTTP, impacting financial and supply-chain integrity.
Affected Products
- Oracle E-Business Suite — Oracle Purchasing 12.2.3
- Oracle E-Business Suite — Oracle Purchasing 12.2.4 through 12.2.14
- Oracle E-Business Suite — Oracle Purchasing 12.2.15
Discovery Timeline
- 2026-09-15 - CVE-2026-87166 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-87166
Vulnerability Analysis
CVE-2026-87166 affects the Oracle Purchasing module within Oracle E-Business Suite versions 12.2.3 to 12.2.15. Oracle categorizes the flaw under an unspecified component ("Other issue"), and the advisory does not publish a CWE classification. The vulnerability is exploitable over the network via HTTP without user interaction. An attacker only requires a low-privileged account within the E-Business Suite environment. Successful exploitation impacts both confidentiality and integrity of Purchasing data, while availability remains unaffected. Given that Oracle Purchasing handles supplier data, purchase orders, requisitions, and pricing agreements, tampering can distort procurement workflows and enable financial fraud.
Root Cause
Oracle has not published the underlying technical root cause. The advisory in Oracle Security Alert CSPUSEP2026 classifies the defect as an "Other issue" within the Purchasing product, which typically indicates an access-control or input-handling weakness in an authenticated HTTP endpoint. The requirement for low privileges combined with high confidentiality and integrity impact suggests broken authorization or missing server-side validation of purchasing-related requests.
Attack Vector
Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privileged account. An attacker sends crafted HTTP requests to Purchasing endpoints to read or manipulate data outside of their intended authorization scope. No user interaction is needed, and the attack does not cross a security boundary between components. Internet-facing deployments face the highest exposure, but any user with basic EBS access can attempt exploitation.
No public proof-of-concept exploit is available for CVE-2026-87166. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-87166
Indicators of Compromise
- Unexpected creation, modification, or deletion of purchase orders, requisitions, or supplier records by low-privileged EBS accounts.
- HTTP requests to Oracle Purchasing endpoints originating from unusual source addresses or outside normal business hours.
- Anomalous access patterns in FND_LOGINS and FND_LOGIN_RESPONSIBILITIES audit tables tied to Purchasing responsibilities.
Detection Strategies
- Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to record Purchasing form and OA Framework page invocations.
- Baseline normal Purchasing transaction volumes per user and alert on statistical deviations.
- Correlate Apache/OHS access logs from the EBS middle tier with Purchasing database changes to identify unauthorized modifications.
Monitoring Recommendations
- Forward EBS application logs, database audit trails, and reverse-proxy logs to a centralized analytics platform for correlation.
- Monitor privileged data changes in Purchasing tables such as PO_HEADERS_ALL, PO_LINES_ALL, and PO_VENDORS.
- Alert on HTTP responses to Purchasing URLs that indicate large data exports or bulk record modifications.
How to Mitigate CVE-2026-87166
Immediate Actions Required
- Apply the fix from Oracle Security Alert CSPUSEP2026 to all Oracle E-Business Suite environments running Purchasing versions 12.2.3 through 12.2.15.
- Inventory all low-privileged accounts with Purchasing responsibilities and remove any that are unnecessary or dormant.
- Restrict inbound HTTP access to the EBS middle tier to trusted networks and VPN users until patching is complete.
Patch Information
Oracle released the fix in the out-of-cycle security alert Oracle Security Alert CSPUSEP2026. Administrators should download the applicable patch for Oracle E-Business Suite 12.2 and apply it following the instructions in the accompanying My Oracle Support notes. Validate the patch in a non-production environment before promoting to production.
Workarounds
- No official workaround is provided by Oracle. Patching is the required remediation path.
- As a compensating control, place a web application firewall in front of the EBS middle tier and enforce strict request inspection on Purchasing URLs.
- Temporarily reduce the attack surface by disabling non-essential Purchasing responsibilities and revoking external network exposure where feasible.
# Example: restrict Oracle E-Business Suite HTTP access to trusted subnets
# (adjust to match your environment; apply on the reverse proxy or firewall)
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
