CVE-2026-87152 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle E-Business Suite environments, especially those with remote access configurations, should assess exposure and prioritize verification and potential remediation based on the vulnerability details provided.

Why it matters

CVE-2026-87152 is a high-severity vulnerability in Oracle Installed Base of Oracle E-Business Suite, allowing low-privileged attackers with network access via HTTP to potentially compromise data integrity and confidentiality. Defenders should prioritize verifying exposure, especially in remote access configurations, and review Oracle security advisories for remediation guidance. The vulnerability's CVSS 3.1 Base Score of 8.1 indicates high severity, emphasizing the need for prompt assessment and potential remediation.

• Potential unauthorized data access or modification in Oracle Installed Base
• Integrity and confidentiality impacts due to low-privileged attacker access
• Need for verification of exposure in Oracle E-Business Suite environments
• Prioritization of remediation based on CVSS 3.1 Base Score of 8.1

Technical summary

The vulnerability in Oracle Installed Base of Oracle E-Business Suite (component: Create Item Instance) allows low-privileged attackers with network access via HTTP to compromise the product. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle Installed Base accessible data, as well as unauthorized access to critical data or complete access to all Oracle Installed Base accessible data. The CVSS 3.1 Base Score is 8.1, indicating high severity due to confidentiality and integrity impacts.

Defensive priority

Defenders should prioritize verifying exposure in Oracle E-Business Suite environments, especially those with remote access, and review Oracle's security advisories for remediation guidance.

Recommended defensive actions

• Verify Oracle E-Business Suite version and Installed Base component configurations
• Assess network exposure and restrict access to HTTP interfaces
• Review Oracle security advisories for potential remediation or patches
• Monitor for suspicious activity related to Oracle Installed Base
• Perform vulnerability scanning and asset inventory of Oracle E-Business Suite environments
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. However, specific remediation steps or exploit details are not provided in the corpus. The vulnerability's CVSS 3.1 Base Score of 8.1 indicates high severity, emphasizing the need for prompt assessment and potential remediation. Defenders should verify exposure, especially in remote access configurations, and review Oracle security advisories for remediation guidance. The CVE record was published on 2026-09-15T20:19:02.660Z and has

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.