CVE-2026-87168: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-87168 Overview

CVE-2026-87168 affects the Oracle Purchasing product within Oracle E-Business Suite, specifically the G-Invoicing component. Supported versions 12.2.10 through 12.2.15 are impacted. An authenticated attacker with low privileges and network access via HTTP can compromise Oracle Purchasing without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical data and complete read access to all Oracle Purchasing accessible data. Oracle disclosed the issue in Security Alert CSPUSEP2026.

Critical Impact
An authenticated, network-based attacker can read, modify, or delete all data accessible to Oracle Purchasing, undermining the integrity and confidentiality of procurement and G-Invoicing records.

Affected Products

Oracle E-Business Suite - Oracle Purchasing (G-Invoicing component)
Versions 12.2.10 through 12.2.15
Deployments exposing Oracle Purchasing HTTP endpoints to authenticated users

Discovery Timeline

2026-09-15 - CVE-2026-87168 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87168

Vulnerability Analysis

The vulnerability resides in the G-Invoicing component of Oracle Purchasing, part of Oracle E-Business Suite. G-Invoicing supports intra-governmental Buy/Sell transactions through HTTP-facing functionality integrated with Oracle Purchasing workflows.

An attacker with a low-privileged Oracle E-Business Suite account can send crafted HTTP requests to the affected component. The requests bypass expected access constraints and allow the attacker to read, insert, modify, or delete records accessible to Oracle Purchasing. No user interaction is required and exploitation complexity is low, according to Oracle's advisory. The current EPSS probability is 0.298% (percentile 22.498).

Root Cause

Oracle's advisory does not publish detailed root cause information. Based on the CVSS metrics and scope, the flaw is consistent with a broken access control or authorization weakness in the G-Invoicing HTTP handlers, where authenticated but low-privileged sessions gain access to operations that should be restricted to higher-privileged procurement roles.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP interface and valid low-privileged credentials. The attacker issues authenticated HTTP requests against G-Invoicing endpoints exposed through Oracle Purchasing. Because scope is unchanged and availability impact is none, the attack focuses on data confidentiality and integrity within the Oracle Purchasing subsystem rather than host takeover.

Oracle has not released public proof-of-concept code. Refer to the Oracle Security Alert CSPUSEP2026 for vendor guidance and additional context.

Detection Methods for CVE-2026-87168

Indicators of Compromise

Unexpected create, update, or delete activity in Oracle Purchasing tables associated with G-Invoicing transactions.
HTTP requests to G-Invoicing endpoints originating from user accounts that do not normally perform procurement operations.
Anomalous session activity from low-privileged Oracle E-Business Suite users accessing purchasing data outside their business scope.

Detection Strategies

Enable Oracle E-Business Suite audit trails on Oracle Purchasing and G-Invoicing tables to record row-level changes with user attribution.
Correlate application-tier HTTP access logs with database audit events to identify unauthorized data modification chains.
Baseline normal G-Invoicing API usage per role and alert on deviations, including bulk record access or off-hours activity.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middleware, and database audit logs to a centralized analytics platform for correlation.
Monitor for privilege changes and new responsibility assignments granted to low-privileged accounts in Oracle E-Business Suite.
Track HTTP response sizes and error rates on G-Invoicing endpoints to detect enumeration or data exfiltration patterns.

How to Mitigate CVE-2026-87168

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert CSPUSEP2026 to all affected Oracle E-Business Suite 12.2.10-12.2.15 environments.
Inventory Oracle Purchasing deployments to confirm exposure of the G-Invoicing component and prioritize internet-reachable instances.
Review recent audit logs on Oracle Purchasing tables for signs of unauthorized data modification prior to patching.

Patch Information

Oracle addressed CVE-2026-87168 in Security Alert CSPUSEP2026. Administrators should download the fix from My Oracle Support and apply it following Oracle's E-Business Suite patching procedures for versions 12.2.10 through 12.2.15. Validate the patch in a non-production environment before production rollout.

Workarounds

Restrict network access to the Oracle E-Business Suite HTTP tier so that only trusted networks and authenticated users can reach G-Invoicing endpoints.
Enforce least privilege by auditing Oracle Purchasing responsibilities and removing unnecessary access from low-privileged accounts.
Enable multi-factor authentication for Oracle E-Business Suite accounts to reduce the risk of credential-based exploitation.

bash

# Configuration example: restrict access to Oracle E-Business Suite HTTP endpoints at the reverse proxy
# Replace <trusted_cidr> with the network ranges permitted to reach G-Invoicing URLs
location ~* /OA_HTML/.*GInvoicing.* {
    allow <trusted_cidr>;
    deny all;
    proxy_pass http://ebs_backend;
}