CVE-2026-87149 Oracle Corporation CVE debrief

Who should care

Defenders managing Oracle E-Business Suite, specifically those with Oracle Contract Lifecycle Management for Public Sector deployments, should assess exposure and prioritize patching. Low-privileged user account holders and network administrators are particularly relevant roles to consider.

Why it matters

CVE-2026-87149 is a high-severity vulnerability in Oracle Contract Lifecycle Management for Public Sector. Defenders should care because it allows low-privileged attackers with network access to potentially access critical data and modify some data. Relevant roles include defenders managing Oracle E-Business Suite and network administrators. The operational impacts include potential data breaches and unauthorized data modifications. Verification of exposure and patching are critical priorities.

• Potential unauthorized access to critical data
• Possible unauthorized updates, inserts, or deletions of some accessible data
• Need for verification of affected versions and exposure
• Priority on applying patches or compensating controls

Technical summary

CVE-2026-87149 is a high-severity vulnerability in Oracle Contract Lifecycle Management for Public Sector, an Oracle E-Business Suite component. A low-privileged attacker with network access via HTTP can exploit this issue, potentially gaining unauthorized access to critical data and the ability to update, insert, or delete some data. The CVSS 3.1 Base Score is 7.1, indicating high confidentiality and integrity impacts.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, focusing on systems with network access and low-privileged users.

Recommended defensive actions

• Verify and apply Oracle patches for CVE-2026-87149
• Restrict network access to Oracle Contract Lifecycle Management for Public Sector
• Monitor for suspicious activity related to low-privileged user accounts
• Conduct an inventory of affected Oracle E-Business Suite deployments
• Review and implement compensating controls for exposed systems
• Track and manage exceptions during remediation
• Plan and schedule vendor-supported updates or mitigations

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. Oracle's security alert also offers insights into the issue. Defenders should verify exposure by checking for affected Oracle Contract Lifecycle Management for Public Sector deployments within their Oracle E-Business Suite environments. This includes identifying low-privileged user accounts with network access via HTTP and assessing potential data breach risks. Verification tasks should focus on confirming the presence of vulnerable

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.