CVE-2026-87156 is a vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations) affecting supported versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise Oracle Product Hub, resulting in unauthorized access to critical data and unauthorized update, insert, or delete operations on some accessible data. The CVSS 3.1 base score is 7.1 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation can lead to unauthorized access to critical data within Oracle Product Hub and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of data but does not impact availability. The vulnerability is exploitable remotely over the network by an attacker with low privileges.

Oracle has released security patches addressing this vulnerability as part of their September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches without delay to remediate this issue. Oracle recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed as available via the official Oracle advisory.