CVE-2026-87265 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Purchasing deployments, especially those with low-privileged network access via HTTP, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-87265 is a high-severity vulnerability in Oracle Purchasing that allows low-privileged attackers to compromise data integrity and confidentiality. Defenders should prioritize verifying exposure, especially in deployments with low-privileged network access via HTTP, and assess the impact of potential unauthorized data access or modification.

• Potential unauthorized creation, deletion, or modification access to critical data.
• Potential unauthorized access to critical data or complete access to all Oracle Purchasing accessible data.
• Requires verification of exposure in Oracle Purchasing deployments.
• Prioritization of remediation efforts based on deployment context.

Technical summary

The vulnerability in Oracle Purchasing (CVE-2026-87265) allows low-privileged attackers with network access via HTTP to compromise Oracle Purchasing, potentially leading to unauthorized creation, deletion, or modification access to critical data or all Oracle Purchasing accessible data, as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. The CVSS 3.1 Base Score is 8.1, indicating high severity.

Defensive priority

Defenders should prioritize verifying exposure in Oracle Purchasing deployments, particularly those with low-privileged network access via HTTP.

Recommended defensive actions

• Verify Oracle Purchasing deployments for exposure, especially those with low-privileged network access via HTTP.
• Assess the impact of unauthorized creation, deletion, or modification access to critical data.
• Review and update access controls to prevent low-privileged attackers from exploiting this vulnerability.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Oracle Purchasing, including CVSS score and vector. The vulnerability affects Oracle Purchasing versions 12.2.3-12.2.15 and allows low-privileged attackers to compromise Oracle Purchasing. The official CVE Program record and NIST NVD detail page offer source-provided CVE metadata and vulnerability assessment. To verify exposure, defenders should review Oracle Purchasing deployments, especially those with low-privileged network access via HTTP, and assess the impact

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.