Threats Tagged 'cve-2026-87166'

A high-severity vulnerability exists in the Oracle Purchasing product of Oracle E-Business Suite versions 12.2.3 through 12.2.15. This vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical data within Oracle Purchasing. The vulnerability has a CVSS 3.1 base score of 8.1, indicating significant confidentiality and integrity impacts. Oracle has released security patches addressing this and many other vulnerabilities in its September 2026 Critical Security Patch Update.

CVE-2026-87166 is a high-severity vulnerability in Oracle Purchasing, part of the Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the application. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, or unauthorized access to all data accessible through Oracle Purchasing. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality and integrity without affecting availability. Oracle has released a Critical Security Patch Update in September 2026 addressing this and other vulnerabilities. Customers are strongly advised to apply the available patches promptly to mitigate risk.