CVE-2026-87150 is a vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite, specifically in the Setup Workbench component. It affects versions 12.2.3 to 12.2.15. The flaw is easily exploitable by a low-privileged attacker with network access via HTTP, potentially leading to full compromise of the Oracle Bills of Material component. The CVSS 3.1 base score is 8.8 with high impact on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability.

Successful exploitation of this vulnerability can result in complete takeover of the Oracle Bills of Material product, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely over the network with low attack complexity and requires low privileges, increasing the risk to affected deployments.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this issue. Oracle recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are indicated in the advisory.