CVE-2026-87265 is a vulnerability in Oracle Purchasing component of Oracle E-Business Suite affecting versions 12.2.3 to 12.2.15. It allows a low-privileged attacker with network access via HTTP to compromise Oracle Purchasing, resulting in unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle has released patches as part of the September 2026 Critical Security Patch Update to remediate this issue.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data in Oracle Purchasing, or unauthorized access to all data accessible by Oracle Purchasing. This compromises confidentiality and integrity of the affected system's data. The vulnerability does not impact availability. The CVSS score of 8.1 indicates a high severity risk.

Oracle has released a security patch for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the provided patches promptly to remediate the vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No additional mitigation steps are indicated beyond patching.