CVE-2026-87169
MediumCVSS 6.1Summary
Vulnerability in Oracle Contract Lifecycle Management for Public Sector (Wage Determination Online component) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP, requiring user interaction, can gain unauthorized update/insert/delete and read access to data. The attack may impact additional products (scope change).
Risk Assessment
Risk includes integrity and confidentiality breach in CLM for public sector and potential impact on other systems.
Recommendation
Update Oracle Contract Lifecycle Management and educate users about interacting with unknown links.
Other vulnerabilities in Oracle Contract Lifecycle Management for Public Sector
See all- CVE-2026-87165High
Vulnerability in Oracle Contract Lifecycle Management for Public Sector (component: ECC For Award and IDV) version V16. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in takeover of the system.
- CVE-2026-87162High
Vulnerability in Oracle Contract Lifecycle Management for Public Sector (component: Award/PO) in versions 12.2.13-12.2.15. A low-privileged attacker can compromise the system over HTTP, leading to full takeover.
- CVE-2026-87149High
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO), affecting versions 12.2.8-12.2.15. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and unauthorized update, insert or delete access to some data.
Original NVD description (English source)
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Wage Determination Online). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Contract Lifecycle Management for Public Sector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Contract Lifecycle Management for Public Sector accessible data as well as unauthorized read access to a subset of Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).