CVE-2026-87162 is a vulnerability in Oracle Contract Lifecycle Management for Public Sector within Oracle E-Business Suite (component Award/PO). It affects supported versions 12.2.13 to 12.2.15. The vulnerability is easily exploitable by an attacker with low privileges who has network access via HTTP, potentially allowing complete takeover of the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle’s September 2026 Critical Security Patch Update advisory confirms that patches addressing this vulnerability are available and strongly recommends applying them without delay.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Contract Lifecycle Management for Public Sector, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over sensitive contract lifecycle management functions.

Oracle has released patches for this vulnerability as part of its September 2026 Critical Security Patch Update. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.