CVE-2026-87165
HighCVSS 8.8Summary
Vulnerability in Oracle Contract Lifecycle Management for Public Sector (component: ECC For Award and IDV) version V16. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in takeover of the system.
Risk Assessment
Risk includes full system takeover, which can lead to compromise of confidentiality, integrity, and availability of data.
Recommendation
Apply Oracle patches for version V16 and restrict HTTP access to the system to trusted users.
Other vulnerabilities in Oracle Contract Lifecycle Management for Public Sector
See all- CVE-2026-87169Medium
Vulnerability in Oracle Contract Lifecycle Management for Public Sector (Wage Determination Online component) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP, requiring user interaction, can gain unauthorized update/insert/delete and read access to data. The attack may impact additional products (scope change).
- CVE-2026-87162High
Vulnerability in Oracle Contract Lifecycle Management for Public Sector (component: Award/PO) in versions 12.2.13-12.2.15. A low-privileged attacker can compromise the system over HTTP, leading to full takeover.
- CVE-2026-87149High
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO), affecting versions 12.2.8-12.2.15. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and unauthorized update, insert or delete access to some data.
Original NVD description (English source)
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: ECC For Award and IDV). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).