CVE-2026-87168 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle E-Business Suite and Oracle Purchasing deployments should assess exposure and prioritize patching or mitigation efforts to prevent potential data integrity and confidentiality impacts.

Why it matters

CVE-2026-87168 is a high-severity vulnerability in Oracle Purchasing that allows low-privileged attackers to compromise data integrity and confidentiality. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential impacts.

• Potential unauthorized creation, deletion, or modification of critical data
• Potential unauthorized access to critical data or complete access to all Oracle Purchasing accessible data
• Need for verification of exposure and application of patches or mitigations
• Potential impacts on data integrity and confidentiality

Technical summary

The vulnerability in Oracle Purchasing (component: G-Invoicing) affects versions 12.2.10-12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Purchasing, leading to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential data integrity and confidentiality impacts.

Recommended defensive actions

• Verify exposure of Oracle Purchasing instances in the environment
• Apply patches or mitigations provided by Oracle
• Monitor for suspicious activity related to Oracle Purchasing
• Review and update access controls for Oracle Purchasing
• Perform a thorough review of Oracle E-Business Suite configurations
• Check for any unauthorized changes to critical data
• Ensure that all Oracle Purchasing components are properly updated and secured

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.1 and potential impacts on confidentiality and integrity. The vulnerability is in the G-Invoicing component of Oracle Purchasing. Oracle E-Business Suite versions 12.2.10-12.2.15 are affected. Defenders should verify exposure and apply patches or mitigations provided by Oracle. The CVE record was published on 2026-09-15T20:19:04.503Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.