CVE-2026-87127 is a vulnerability in the Oracle Purchasing product of Oracle E-Business Suite, specifically in the G-Invoicing component. It affects versions 12.2.10 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise Oracle Purchasing. The vulnerability has a CVSS 3.1 base score of 7.7 with a vector indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Successful exploitation can result in unauthorized access to critical or all data accessible by Oracle Purchasing. Oracle’s September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 others, and Oracle strongly recommends applying these patches promptly.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Purchasing. The vulnerability affects confidentiality but does not impact integrity or availability. The scope of the attack extends beyond Oracle Purchasing to additional products, indicating a broader impact within the Oracle E-Business Suite environment.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to mitigate the risk. Oracle recommends remaining on actively supported versions and promptly applying security patches. No alternative mitigations or workarounds are specified in the advisory.