CVE-2026-87167: Oracle E-Business Suite Auth Bypass Vulnerability

CVE-2026-87167 Overview

CVE-2026-87167 affects the Oracle Purchasing product within Oracle E-Business Suite, specifically the G-Invoicing component. The vulnerability impacts supported versions 12.2.11 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this flaw to compromise Oracle Purchasing. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, along with unauthorized access to all Oracle Purchasing accessible data. Oracle disclosed this vulnerability in Security Alert CSPUSEP2026.

Critical Impact
Authenticated attackers with minimal privileges can read, modify, or delete critical financial procurement data across the entire Oracle Purchasing module.

Affected Products

Oracle E-Business Suite — Oracle Purchasing (G-Invoicing component) version 12.2.11
Oracle E-Business Suite — Oracle Purchasing (G-Invoicing component) versions 12.2.12 through 12.2.14
Oracle E-Business Suite — Oracle Purchasing (G-Invoicing component) version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87167 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87167

Vulnerability Analysis

The vulnerability resides in the G-Invoicing component of Oracle Purchasing. G-Invoicing supports intragovernmental Buy/Sell transactions between U.S. federal agencies. The flaw allows an authenticated user with low privileges to bypass intended access controls on data operations exposed through HTTP. Attackers can perform unauthorized reads and writes against data accessible to the Purchasing module. Because Purchasing integrates tightly with financial, supplier, and procurement workflows, tampering can propagate into downstream processes such as purchase order approvals, invoice matching, and supplier payment records. The Oracle advisory categorizes the impact as high for both confidentiality and integrity, with no direct availability impact.

Root Cause

Oracle has not published detailed root cause information in the public advisory. The CVSS vector indicates a network-reachable HTTP endpoint in Oracle Purchasing that fails to properly enforce authorization for data operations. The issue is consistent with a broken access control weakness in the G-Invoicing request-handling logic, where privilege checks do not adequately restrict which records a low-privileged authenticated session can access or modify.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privileged account. The attacker sends crafted HTTP requests to the G-Invoicing component to trigger unauthorized data operations. No user interaction and no elevated privileges are required. The unchanged scope means the impact is contained within the vulnerable Oracle Purchasing component, but that scope still includes all Purchasing-accessible data.

No public proof-of-concept exploit is available at the time of publication. Refer to the Oracle Security Alert CSPUSEP2026 for vendor technical details.

Detection Methods for CVE-2026-87167

Indicators of Compromise

Unexpected HTTP requests to G-Invoicing endpoints from user accounts that do not normally interact with intragovernmental invoicing workflows.
Audit log entries showing create, update, or delete operations on Purchasing records performed by low-privileged accounts outside their assigned responsibilities.
Anomalous spikes in Oracle Purchasing data modifications during non-business hours or from unusual source IP addresses.

Detection Strategies

Review Oracle E-Business Suite audit trail (FND_LOG_MESSAGES, FND_AUDIT_TRAIL) for G-Invoicing transactions executed by accounts lacking the appropriate responsibility assignments.
Correlate web tier access logs against application-level user identities to flag HTTP requests targeting G-Invoicing URLs from unauthorized sessions.
Establish baselines of normal Purchasing data modification rates per user and alert on statistical deviations.

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and web tier logs to a centralized analytics platform for cross-source correlation.
Enable Oracle Fine-Grained Auditing (FGA) on Purchasing tables involved in G-Invoicing flows to capture row-level access events.
Monitor for privilege changes, new responsibilities, and role assignments on accounts that subsequently access G-Invoicing functionality.

How to Mitigate CVE-2026-87167

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in Security Alert CSPUSEP2026 to all Oracle E-Business Suite instances running versions 12.2.11 through 12.2.15.
Inventory all Oracle Purchasing deployments and confirm patch status for the G-Invoicing component.
Audit user accounts with access to Oracle Purchasing and remove unnecessary responsibilities, especially G-Invoicing-related ones.
Restrict network exposure of the Oracle E-Business Suite HTTP interface to trusted networks and VPN users only.

Patch Information

Oracle addressed CVE-2026-87167 in Security Alert CSPUSEP2026. Administrators should download and apply the fix as documented in the Oracle Security Alert CSPUSEP2026. Test the patch in a non-production environment before promoting to production, and validate G-Invoicing transaction workflows post-deployment.

Workarounds

Disable the G-Invoicing component if the organization does not use intragovernmental Buy/Sell functionality until the patch is applied.
Place the Oracle E-Business Suite HTTP tier behind a web application firewall with rules blocking unauthenticated or anomalous access to G-Invoicing URLs.
Enforce strict least-privilege responsibility assignments so that only designated procurement staff can access Purchasing functions.

bash

# Example: restrict access to G-Invoicing URLs at the reverse proxy tier
# (adjust module names and paths to match the local EBS deployment)
location ~* /OA_HTML/.*GInvoicing.* {
    allow 10.0.0.0/8;      # internal procurement network
    deny  all;
    proxy_pass http://ebs-app-tier;
}