CVE-2026-87151 is a vulnerability in the Oracle Bills of Material product (component: Setup Workbench) of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with low privileges and network access over HTTP, allowing compromise of Oracle Bills of Material. Successful exploitation can result in unauthorized access to critical or complete data within the product. The vulnerability has a CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches across multiple products. Oracle advises customers to apply patches without delay to mitigate exploitation risks.

The vulnerability allows unauthorized access to critical or all accessible data within Oracle Bills of Material, potentially compromising confidentiality. The scope change indicates that other Oracle products may also be impacted by attacks exploiting this vulnerability. There is no impact on integrity or availability according to the CVSS vector. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the official Oracle patches promptly to remediate this issue. No alternative mitigations or workarounds are indicated in the vendor advisory. Staying on actively supported versions and timely patching are critical to prevent exploitation.