CVE-2026-87158

Received Received - Intake

Oracle Order Management Unauthorized Data Access Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-18

Assigner: Oracle

Description

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Enterprise Command Center). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Order Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-18

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-87158

EUVD

EUVD-2026-79813

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	order_management	16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Order Management within Oracle E-Business Suite. It allows a low-privileged attacker with network access to exploit it via HTTP. Successful exploitation can lead to unauthorized access to critical data or full access to all accessible data in Oracle Order Management. It may also permit unauthorized modifications to some data.

Detection Guidance

Detection requires monitoring Oracle Order Management logs and network traffic for unauthorized access attempts. Check HTTP requests to the Enterprise Command Center component for unusual activity. Review user privileges and data modification logs in Oracle E-Business Suite.

Impact Analysis

If you use Oracle Order Management, an attacker could gain unauthorized access to sensitive data or modify certain data. This could lead to data breaches, financial loss, or operational disruptions depending on the data compromised.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate GDPR, HIPAA, or other regulations. Non-compliance risks include legal penalties, fines, and reputational damage due to data exposure or tampering.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches or updates for Oracle Order Management V16 as soon as possible to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-87158. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70