CVE-2026-87165

Executive Summary

CVE-2026-87165 is an easily exploitable access-control/privilege vulnerability in the ECC For Award and IDV component of Oracle Contract Lifecycle Management for Public Sector, a module of Oracle E-Business Suite, affecting version V16. A low-privileged attacker with network access via HTTP can exploit the flaw to achieve full takeover of the affected product. With a CVSS 3.1 base score of 8.8 and High confidentiality, integrity, and availability impacts, this vulnerability represents a serious risk to public-sector procurement environments that expose the application to untrusted networks.

Technical Analysis

CVE-2026-87165 resides in the ECC For Award and IDV component of Oracle Contract Lifecycle Management for Public Sector, an E-Business Suite module used to manage government contract awards and Indefinite Delivery/Indefinite Quantity (IDV) vehicles. The supported affected version is V16.

The NVD description classifies this as a vulnerability that is "easily exploitable" by a low-privileged attacker with network access via HTTP. Successful exploitation results in takeover of the product. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H tells us several concrete things about the flaw class:

• AV:N (Network) — the attack is delivered over the network; the description explicitly states HTTP, meaning it is reachable through the web/application tier rather than requiring local host access.
• AC:L (Low complexity) — no special conditions or race windows are required; the attack is repeatable and reliable.
• PR:L (Low privileges required) — the attacker must possess some authenticated foothold (a low-privileged user account), but no administrative rights.
• UI:N (No user interaction) — the victim does not need to click a link or open a file; the attacker drives the exploit directly.
• S:U (Unchanged scope) — the impact stays within the security authority of the vulnerable component.
• C:H/I:H/A:H — full loss of confidentiality, integrity, and availability within the affected product.

Taken together, this is a classic improper access control / privilege escalation condition: an authenticated low-privileged user is able to invoke functionality or reach data that should be restricted to higher-privileged roles, and doing so escalates to complete control of the Contract Lifecycle Management application ("takeover"). The "takeover" language in the NVD description is significant — it indicates the attacker can gain administrative control of the application rather than merely reading a single record.

Insufficient technical detail is available to name the specific vulnerable servlet, REST endpoint, JSP, PL/SQL package, or parameter involved. NVD provides no CWE classification, no code references, no PoC, and no exploit code. The exact request that triggers the flaw is therefore not derivable from the available data, and no implementation-specific identifiers should be assumed. What can be stated with confidence is the vulnerability class (broken authorization / missing privilege enforcement on a network-reachable, HTTP-accessible function) and the exploitation preconditions (authenticated low-privileged network access).

Because Oracle E-Business Suite deployments are typically internet-facing for supplier, contractor, and public-sector partner access, the "network access via HTTP" exposure is realistic in production. The absence of an EPSS score (not yet scored by FIRST.org) and the lack of CISA KEV listing mean there is no confirmed exploitation-in-the-wild signal at this time — but the Low complexity and Low privilege requirements make weaponization attractive if a PoC emerges.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (broken access control on an HTTP-reachable function) and the CVSS vector. No function names, endpoints, or parameters are fabricated.

1. Reconnaissance / target identification. The attacker identifies an internet- or partner-network-reachable Oracle Contract Lifecycle Management for Public Sector V16 deployment (Oracle E-Business Suite). Fingerprinting focuses on the EBS web tier and the CLM/ECC module's HTTP surface. A low-privileged account — e.g., a supplier, contractor, or limited procurement user with legitimate login credentials — is either already held or obtained through unrelated means.

2. Triggering the flaw. Using the low-privileged session, the attacker issues HTTP requests to functionality in the ECC For Award and IDV component that fails to enforce proper authorization. Because the CVSS vector shows PR:L and AC:L with UI:N, the access-control check is either absent or trivially bypassable for an authenticated low-privileged user — no victim interaction and no complex conditions are needed.

3. Execution method (class level). The attack is carried out at the application layer over HTTP by abusing the missing/inadequate authorization check. The attacker does not need a memory-corruption primitive; the flaw is an authorization failure that lets a low-privileged user perform actions or reach data reserved for higher-privileged roles or other tenants/parties.

4. Post-exploitation impact. NVD states successful attacks "can result in takeover of Oracle Contract Lifecycle Management for Public Sector." In practice this means elevation to effective administrative control of the CLM application, enabling manipulation or exfiltration of contract award and IDV data (Confidentiality: High), tampering with procurement records and workflow (Integrity: High), and disruption of contract lifecycle services (Availability: High).

Impact Assessment

Confidentiality (High): Contract award and IDV records in a public-sector procurement system are commercially and politically sensitive; disclosure can expose bid data, pricing, and supplier information.

Integrity (High): An attacker with takeover capability can alter contract awards, approvals, and IDV vehicles — a severe outcome in public procurement, with fraud, compliance, and legal-recourse implications.

Availability (High): Takeover of the CLM application can disrupt contract award and IDV workflows across the procurement lifecycle.

Blast radius: The direct scope is the affected CLM/EBS application instance (CVSS S:U — impact confined to the vulnerable component's authority). However, E-Business Suite modules frequently share authentication, database, and integration tiers; a takeover of CLM can serve as a pivot point into adjacent EBS modules and connected financial or supplier systems depending on deployment architecture. Organizations running Oracle E-Business Suite V16 Contract Lifecycle Management for Public Sector and exposing it to partner or internet networks carry the highest risk. The combination of Network vector, Low complexity, Low privileges, and No user interaction makes this attractive to both external attackers with any valid low-privilege credential and malicious insiders.

Detection Guidance

Sigma Rule

title: Potential Oracle E-Business Suite CLM ECC For Award and IDV Access Control Abuse (CVE-2026-87165)
id: 7f3c1a2e-9b4d-4e21-8a6f-cve202687165
status: experimental
description: Detects suspicious HTTP access patterns against Oracle E-Business Suite Contract Lifecycle Management for Public Sector (ECC For Award and IDV) that may indicate exploitation of CVE-2026-87165, an access-control flaw allowing low-privileged takeover.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87165
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: oracle
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_path:
    cs-uri-stem|contains:
      - '/OA_HTML/'
      - '/CLM'
      - '/ECC'
      - 'Award'
      - 'IDV'
  selection_priv:
    sc-status:
      - 200
      - 302
  condition: selection_method and selection_path and selection_priv
falsepositives:
  - Legitimate low-privileged users navigating CLM award and IDV screens
  - Application health checks
level: medium
tags:
  - attack.t1190
  - cve.2026.87165

YARA Rule

rule CVE_2026_87165_Oracle_EBS_CLM_Exploit_Artifacts
{
    meta:
        description = "Detects artifacts and references associated with CVE-2026-87165, an access-control takeover flaw in Oracle E-Business Suite Contract Lifecycle Management for Public Sector (ECC For Award and IDV)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87165"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cve = "CVE-2026-87165" ascii wide nocase
        $clm1 = "Contract Lifecycle Management for Public Sector" ascii wide nocase
        $clm2 = "ECC For Award and IDV" ascii wide nocase
        $ebs = "E-Business Suite" ascii wide nocase
        $exp1 = "low privileged attacker" ascii wide nocase
        $exp2 = "takeover" ascii wide nocase

    condition:
        $cve or (2 of ($clm*) and $ebs) or (any of ($exp*) and 1 of ($clm*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87165 Oracle E-Business Suite CLM ECC For Award and IDV Suspicious Access"; flow:established,to_server; http.uri; content:"/OA_HTML/"; http.uri; content:"CLM"; nocase; http.method; content:"GET"; http.method; content:"POST"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-admin; reference:cve,2026-87165; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87165; sid:202687165; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where network.protocol == "http" and url.path : ("/OA_HTML/*") and url.path : "*CLM*" ]
  [ network where network.protocol == "http" and http.response.status_code == 200 ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri_path, url, dest_url)
| where match(uri, "(?i)(OA_HTML|CLM|ECC|Award|IDV)")
| where match(uri, "(?i)(?:\/OA_HTML\/|\/CLM|\/ECC)")
| stats count values(uri) as uris by src_ip, user, status
| where count >= 5
| sort - count
| rename src_ip as src, user as account

Wazuh OSSEC Rule

<group name="web,oracle,ebs,cve_2026_87165,">
  <rule id="202687165" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.*(OA_HTML|CLM|ECC).*</field>
    <field name="url">(?i)(Award|IDV)</field>
    <regex field="id">^-$</regex>
    <description>CVE-2026-87165: Possible exploitation of Oracle E-Business Suite CLM ECC For Award and IDV access-control flaw by low-privileged user</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87165,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). At the time of writing, no vendor fix, workaround, or affected-version enumeration has been published in any tracked source, and the vulnerability is not listed in CISA KEV. Treat all guidance below as compensating controls.

1) Immediate mitigations

• Restrict network reachability of the Oracle Contract Lifecycle Management for Public Sector V16 web tier. Remove direct internet exposure where possible; enforce access only through a VPN, zero-trust proxy, or IP allow-listing.
• Review and minimize low-privileged accounts. Because PR:L is required, reducing the population of low-privileged CLM users directly shrinks the attack surface. Enforce least privilege and disable stale/dormant accounts.
• Apply strict segregation between low-privileged roles and any award/IDV administrative functionality at the reverse-proxy/WAF layer where feasible.
• Enforce MFA and strong session controls on all CLM access to raise the cost of obtaining the low-privileged foothold the flaw requires.
• Deploy the Sigma/Suricata/Wazuh detections above to identify abnormal access to CLM/EBS award and IDV functionality.

2) Patch / upgrade steps

• Monitor the Oracle Critical Patch Update (CPU) and Oracle Security Alerts feeds for a fix to Contract Lifecycle Management for Public Sector V16 addressing this component. No patch identifier is available yet.
• When a fix ships, test in a non-production EBS instance and apply during a maintenance window; restart affected application services.
• Track NVD and the Oracle Security Alerts page for the definitive affected-version and patch mapping.

3) Long-term hardening

• Adopt a recurring EBS patch cadence aligned to Oracle CPUs and maintain a current supported version.
• Implement centralized authorization review and periodic access recertification for procurement/CLM roles.
• Deploy a WAF with virtual patching capability and maintain egress/ingress monitoring for the EBS web tier.
• Enable comprehensive HTTP and application audit logging and forward to a SIEM for correlation with the detections above.
• Segment EBS database and integration tiers so that a CLM takeover cannot trivially pivot into adjacent financial systems.

References

• NVD — CVE-2026-87165: https://nvd.nist.gov/vuln/detail/CVE-2026-87165
• Oracle Security Alerts (vendor advisory portal — no specific advisory identified for this CVE at time of writing): https://www.oracle.com/security-alerts/
• Oracle Critical Patch Updates (CPU) program: https://www.oracle.com/security-alerts/cpujul.html
• FIRST.org EPSS (not yet scored for CVE-2026-87165): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-87165 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No public PoC, no exploit code, no Nuclei template, no CISA KEV listing, and no EPSS score are available. There is currently no evidence of active exploitation in the wild for CVE-2026-87165. No specific threat actor campaigns can be attributed. Given the Low-complexity, Low-privilege, no-user-interaction profile, organizations should treat this as a high-priority hardening target pending an Oracle fix.