CVE-2026-87166 is a vulnerability in Oracle Purchasing component of Oracle E-Business Suite affecting versions 12.2.3 through 12.2.15. It allows a low-privileged attacker with network access via HTTP to compromise Oracle Purchasing, resulting in unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Purchasing, potentially compromising confidentiality and integrity of all data accessible through Oracle Purchasing. This could affect business operations relying on accurate purchasing data and may expose sensitive information.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.