CVE-2026-87167 is a vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing) affecting versions 12.2.11 to 12.2.15. It allows a low-privileged attacker with network access via HTTP to compromise Oracle Purchasing, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all Oracle Purchasing accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N with a base score of 8.1. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update, which includes targeted security fixes for this and many other vulnerabilities. Oracle strongly recommends applying the provided patches promptly to mitigate this risk.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Purchasing, as well as unauthorized access to all data accessible by Oracle Purchasing. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and promptly applying all security updates. Patch status is confirmed as official-fix available via Oracle's advisory.