CVE-2026-87169 is a vulnerability in the Oracle Contract Lifecycle Management for Public Sector product within Oracle E-Business Suite, specifically in the Wage Determination Online component. It affects versions 12.2.3 through 12.2.15. The flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations, as well as unauthorized read access to some accessible data. Exploitation requires user interaction from a person other than the attacker and has a scope change impact affecting additional products. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Oracle has included fixes for this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible by Oracle Contract Lifecycle Management for Public Sector. The attack requires user interaction from a different user and can affect additional products beyond the immediate component due to scope change. The vulnerability impacts confidentiality and integrity but not availability.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. No indication from the vendor advisory suggests that no action is required or that the vulnerability is already mitigated without patching. Therefore, patching is the recommended remediation.