CVE-2026-87158 is a vulnerability in Oracle Order Management (Enterprise Command Center) of Oracle E-Business Suite version V16. It permits a low privileged attacker with network access via HTTP to compromise Oracle Order Management, resulting in unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality and low integrity impacts without availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 other fixes.

Successful exploitation can lead to unauthorized access to critical data within Oracle Order Management and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network by an attacker with low privileges and no user interaction is required.

Oracle has released patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends staying on actively-supported versions and applying security updates without delay. No alternative mitigations or workarounds are specified in the advisory.