CVE-2026-87151 is a vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite, specifically in the Setup Workbench component. It affects supported versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 7.7 with a vector indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data within Oracle Bills of Material and may also affect additional Oracle products due to scope change. The confidentiality of sensitive information is at high risk, but there is no direct impact on integrity or availability. The vulnerability is exploitable remotely over the network by an attacker with low privileges.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.