Threat Intelligence Database

CVE-2026-87169 is a vulnerability in Oracle Contract Lifecycle Management for Public Sector versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized read and write operations on accessible data, requiring user interaction from a person other than the attacker. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with confidentiality and integrity impacts. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security fixes.

CVE-2026-87162 is a high-severity vulnerability in Oracle Contract Lifecycle Management for Public Sector versions 12.2.13 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this fix in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk.

CVE-2026-87149 is a high-severity vulnerability in Oracle Contract Lifecycle Management for Public Sector versions 12.2.8 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating significant confidentiality and integrity impacts. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update advisory.