CVE-2026-87149
HighCVSS 7.1Summary
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO), affecting versions 12.2.8-12.2.15. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and unauthorized update, insert or delete access to some data.
Risk Assessment
Compromise of confidentiality and integrity of contract data can have serious consequences for public sector organizations. CVSS 7.1 indicates high risk.
Recommendation
Urgently apply Oracle patches and audit user privileges in the Award/PO module.
Other vulnerabilities in Oracle Contract Lifecycle Management for Public Sector
See all- CVE-2026-87169Medium
Vulnerability in Oracle Contract Lifecycle Management for Public Sector (Wage Determination Online component) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP, requiring user interaction, can gain unauthorized update/insert/delete and read access to data. The attack may impact additional products (scope change).
- CVE-2026-87165High
Vulnerability in Oracle Contract Lifecycle Management for Public Sector (component: ECC For Award and IDV) version V16. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in takeover of the system.
- CVE-2026-87162High
Vulnerability in Oracle Contract Lifecycle Management for Public Sector (component: Award/PO) in versions 12.2.13-12.2.15. A low-privileged attacker can compromise the system over HTTP, leading to full takeover.
Original NVD description (English source)
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data as well as unauthorized update, insert or delete access to some of Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).