CVE-2026-87158
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in Oracle Order Management (component: Enterprise Command Center) in version V16. A low-privileged attacker can gain unauthorized access to critical data and modify some data via HTTP.
Risk Assessment
Moderate risk – unauthorized access to critical data and partial modification.
Recommendation
Apply Oracle patches for version V16. Restrict access to the system.
Other vulnerabilities in Oracle Order Management
See all- CVE-2026-87157High
Vulnerability in Oracle Order Management (component: Product Diagnostic Tools) in versions 12.2.4-12.2.15. A low-privileged attacker can create, delete, or modify critical data and gain full access via HTTP.
- CVE-2026-83116High
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Affected supported versions are 12.2.5-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Order Management, with potential significant impact on additional products (scope change).
- CVE-2026-70932High
Vulnerability in Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Affects versions 12.2.3-12.2.15. A high-privileged attacker with local access can gain unauthorized access to critical data and modify or delete it, and attacks may impact additional products.
- CVE-2026-70930High
Vulnerability in Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Affects versions 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks can result in takeover of Oracle Order Management.
- CVE-2026-70760High
Vulnerability in Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Affects versions 12.2.3-12.2.15. Difficult to exploit by low-privileged attacker via HTTP, with potential impact on other products (scope change). Allows unauthorized access to critical data and unauthorized update/insert/delete of some data.
- CVE-2026-61115High
Vulnerability in Oracle Order Management (Oracle E-Business Suite) allows a high-privileged attacker with network access via HTTP to take over the system. Affects versions 12.2.3-12.2.15.
- CVE-2026-60864Medium
Vulnerability in Oracle Order Management (Product Diagnostic Tools) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can compromise confidentiality and integrity, affecting additional products.
- CVE-2026-60862Medium
Vulnerability in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3-12.2.15. An authenticated attacker with high privileges can access critical data via HTTP, with potential impact on other products (scope change).
Original NVD description (English source)
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Enterprise Command Center). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Order Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS