Threat Intelligence Report — CVE-2026-87169

Executive Summary

CVE-2026-87169 is an easily exploitable, unauthenticated, network-reachable vulnerability in the Wage Determination Online component of Oracle Contract Lifecycle Management for Public Sector, part of Oracle E-Business Suite (affected versions 12.2.3 through 12.2.15). Successful exploitation requires human interaction from a victim other than the attacker and results in a scope change — meaning the compromise of the Oracle product can significantly impact additional products — with limited confidentiality and integrity impact, yielding a CVSS 3.1 base score of 6.1 (Medium). No public proof-of-concept, exploit code, or Nuclei template is currently available, and the CVE is not listed in CISA KEV; EPSS is 0.00253 (16.9th percentile), indicating low but non-zero near-term exploitation probability.

Technical Analysis

CVE-2026-87169 resides in Oracle E-Business Suite's Contract Lifecycle Management for Public Sector product, specifically the Wage Determination Online component. Per the NVD description, the affected supported versions are 12.2.3–12.2.15.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N encodes the following properties, each of which constrains and informs the technical picture:

• AV:N (Network) — the attack is delivered over the network via HTTP. The vulnerable interface is web-exposed.
• AC:L (Low Complexity) — no special preconditions (race conditions, precise timing, memory grooming) are required. Attack repeatability is high.
• PR:N (No Privileges Required) — the attacker does not need to be authenticated to the Oracle application to initiate the attack.
• UI:R (User Interaction Required) — exploitation requires a victim to perform some action (e.g., visit a crafted link or interact with crafted content delivered through the application). This is the defining characteristic that separates this issue from a fully automated remote exploit.
• S:C (Scope Change) — a successful attack against the vulnerable component can affect resources beyond the Oracle CLM for Public Sector security authority, "significantly impacting additional products." This indicates the vulnerability can be leveraged as a pivot or to affect downstream consumers of the affected function.
• C:L / I:L (Low Confidentiality, Low Integrity) — an attacker can gain unauthorized read access to a subset of data and unauthorized update, insert, or delete access to some data accessible through the application. There is no availability (A:N) impact.

The presence of PR:N combined with UI:R, S:C, and the read/write impact profile is consistent with a client-side / reflected input-handling class of flaw (i.e., a web-layer injection such as Cross-Site Scripting being the most probable class), where attacker-supplied input is rendered to an authenticated victim's browser and executes within the trust context of the application, enabling data manipulation on the victim's behalf and potential effect on other integrated products (scope change).

Important accuracy caveat: The NVD description does not disclose a CWE, the specific parameter, endpoint, or function name involved. No public advisory detail naming the vulnerable code path is available. Therefore, this report describes the vulnerability class and attack mechanism rather than asserting specific implementation identifiers. It is not possible to state with certainty whether the underlying flaw is XSS, request forgery, or another web-layer injection class; the CVSS profile most strongly suggests a client-side injection requiring victim interaction. Any organization relying on precise exploitation mechanics should treat the class-level analysis as provisional pending vendor detail.

Exploitation Scenarios

The attack chain below is derived strictly from the NVD description and the provided CVSS data. No public PoC exists; the chain is inferred at the vulnerability-class level. Specific endpoint paths, parameter names, or function names are intentionally omitted because they are not available in the source data.

1. Reconnaissance / Target Identification An attacker identifies an externally reachable Oracle E-Business Suite deployment running Contract Lifecycle Management for Public Sector versions 12.2.3–12.2.15, with the Wage Determination Online component exposed over HTTP. Fingerprinting would target the Oracle EBS login/landing surface via HTTP (matching the AV:N vector). The Shodan dorks in the METADATA section can assist in enumerating candidate internet-facing instances.

2. Triggering the Flaw Class Because the vector specifies PR:N (no authentication) and UI:R (user interaction), the attacker crafts input that is accepted by the unauthenticated-facing component and later rendered or processed when a legitimate user interacts with it. The UI:R requirement means the attacker must induce a victim — plausibly an authenticated CLM user or a user navigating the Wage Determination Online interface — to interact with attacker-influenced content. At the class level, this is characteristic of a client-side injection where attacker-controlled data reaches the victim's browser through the application.

3. Payload / Execution Method (class level) The payload is delivered over the network via HTTP (per AV:N) and executes in the context of the affected component when the victim interacts with it (per UI:R). Because S:C applies, the executed action can influence resources beyond the immediate component's security boundary. No attacker authentication is needed to stage the input (per PR:N), and no complex conditions are required to trigger it (per AC:L).

4. Post-Exploitation Impact As specified by the CVSS impacts, a successful attack grants the attacker unauthorized read access to a subset of application data (C:L) and unauthorized update, insert, or delete access to some accessible data (I:L), all without availability impact (A:N). The scope change (S:C) means the impact can extend to additional products integrated with the affected Oracle component.

Note: No public PoC is available; the above attack chain is inferred from the vulnerability class and the supplied CVSS characteristics only.

Impact Assessment

• Business Impact: Organizations running Oracle E-Business Suite Contract Lifecycle Management for Public Sector (v12.2.3–12.2.15) — notably public-sector and government contracting entities, given the product's name — face unauthenticated, network-reachable risk of data tampering and data disclosure within the CLM application. Because the component concerns wage determinations, integrity of that data is materially important to contracting and compliance workflows.
• Affected Systems: Oracle E-Business Suite deployments hosting the CLM for Public Sector module, versions 12.2.3 through 12.2.15, with the Wage Determination Online component reachable over HTTP.
• Blast Radius / Scope: The S:C (scope change) rating explicitly elevates the risk: the vulnerability in CLM for Public Sector may "significantly impact additional products," meaning adjacent or integrated systems inherit risk from a single component compromise.
• CVSS Subscore Interpretation:
  • Confidentiality: Low — read access limited to a subset of data.
  • Integrity: Low — unauthorized update/insert/delete of some accessible data.
  • Availability: None.
  • Exploitability: AV:N/AC:L/PR:N — no credentials, low complexity, network reachable — but constrained by UI:R, which reduces mass-exploitation viability.
• Exploit Likelihood: Low-to-moderate. EPSS 0.00253 (16.9th percentile) indicates low modeled near-term exploitation. Not in CISA KEV. No public PoC or exploit code presently observed.
• Overall: A medium-severity, easily staged but interaction-gated vulnerability with scope-escalation characteristics. Prioritize based on internet exposure of the EBS CLM interface and the sensitivity of wage-determination and contract data.

Detection Guidance

The rules below target the vulnerability class (HTTP-delivered client-side injection requiring user interaction against the Oracle EBS CLM interface) since no specific endpoint or parameter is disclosed. Tune hostnames, paths, and Oracle EBS URL patterns to your environment before deployment.

Sigma Rule

title: Suspected Client-Side Injection Against Oracle EBS CLM Wage Determination Online (CVE-2026-87169)
id: 6a1f2c9e-8716-4cve-9f0a-000000000169
status: experimental
description: Detects HTTP requests delivering script/HTML payloads to Oracle E-Business Suite Contract Lifecycle Management (Wage Determination Online) consistent with an unauthenticated, interaction-gated client-side injection (CVE-2026-87169).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87169
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: oracle_ebs
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_path:
    cs-uri-stem|contains:
      - 'CLM'
      - 'WageDetermination'
      - 'WageDeterminationOnline'
      - 'oracle'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3Cscript'
      - '%3Csvg'
  condition: selection_method and selection_payload and selection_path
falsepositives:
  - Legitimate administrative content containing script-like parameters
  - Application input that legitimately includes "<" or "onload" strings
level: medium
tags:
  - attack.t1190
  - cve.2026.87169

YARA Rule

rule CVE_2026_87169_OracleCLM_WageDetermination_XSS
{
    meta:
        description = "Detects reflected client-side injection payloads targeting Oracle E-Business Suite CLM Wage Determination Online (CVE-2026-87169)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87169"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $p1 = "<script" nocase
        $p2 = "javascript:" nocase
        $p3 = "onerror=" nocase
        $p4 = "onload=" nocase
        $p5 = "<svg" nocase
        $c1 = "WageDetermination" nocase
        $c2 = "Wage Determination" nocase
        $c3 = "oracle" nocase

    condition:
        uint16(0) == 0x3C21 or uint16(0) == 0x4745 or // <! or GE (HTTP response start heuristic)
        (any of ($p*) and any of ($c*))
}

Notes: This is a content-based heuristic rule; it fires on payload bytes in request/response bodies. It is intentionally broad to catch the injection class and should be scoped in your pipeline. Confidence in matching is low-to-moderate given the absence of vendor-disclosed specifics.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87169 Possible Client-Side Injection Against Oracle EBS CLM Wage Determination (user-interaction required)"; flow:to_server,established; http.method; content:"GET" or content:"POST"; http.uri; content:"WageDetermination"; nocase; http.uri; content:"<script" or content:"%3Cscript" or content:"onerror" or content:"onload"; nocase; classtype:web-application-attack; reference:cve,2026-87169; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87169; sid:2026871691; rev:1;)

This rule anchors on the Wage Determination component name and common script-injection tokens traversing to the Oracle server. Adjust content matching to your EBS URL scheme; combine with TLS inspection where EBS is served over HTTPS.

Elastic Detection

sequence by source.ip with maxspan=15m
  [ network where http.request.method in ("GET","POST")
      and url.path contains "WageDetermination"
      and http.request.body.text contains ("<script" or "onerror=" or "onload=" or "javascript:") ]

EQL sequence form is provided so that a reconnaissance/landing request followed by an injection-bearing request within the same client can be correlated. If your data source only has one event per request, simplify to a single network where ... condition.

Splunk SPL Query

index=web OR index=proxy (sourcetype=access_combined OR sourcetype=*oracle* OR sourcetype=*ebs*)
| eval uri=lower(coalesce(uri, url, cs_uri_stem))
| eval query=lower(coalesce(query, cs_uri_query, http_request))
| where (match(uri, "wagedetermination") OR match(uri, "clm"))
    AND (match(query, "<script") OR match(query, "%3cscript") OR match(query, "onerror") OR match(query, "onload") OR match(query, "javascript:"))
| stats count min(_time) as first_seen max(_time) as last_seen values(clientip) as src values(uri) as targeted_uri by host, src
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Detect injection tokens arriving against Oracle EBS CLM/Wage Determination URLs. Baseline normal traffic so legitimate < characters in query strings do not flood results.

Wazuh OSSEC Rule

<group name="web,oracle,cve-2026-87169,">
  <rule id="202687169" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">WageDetermination|CLM</field>
    <match>(?i)(<script|%3Cscript|onerror=|onload=|javascript:)</match>
    <description>CVE-2026-87169: Possible client-side injection against Oracle EBS CLM Wage Determination Online (user-interaction required)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,cve_2026_87169,</group>
  </rule>

  <rule id="202687170" level="12">
    <if_sid>202687169</if_sid>
    <same_source_ip />
    <description>CVE-2026-87169: Repeated injection attempts against Oracle EBS CLM from same source IP</description>
    <group>web_attack,cve_2026_87169,</group>
  </rule>
</group>

Assumes web access logs are decoded by the web-accesslog decoder. Adjust field name="url" to match your decoder's field extraction for Oracle EBS access logs.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. No vendor fix, workaround, or upstream reference is currently available for this CVE ID. The affected version range is 12.2.3–12.2.15.

1) Immediate Mitigations

• Restrict network exposure of the Oracle E-Business Suite CLM for Public Sector / Wage Determination Online interface. Do not expose it directly to the internet; place it behind a VPN, zero-trust gateway, or authenticated reverse proxy (AV:N + PR:N are the primary exposure drivers).
• Enforce MFA and session hygiene for all EBS/CLM user accounts, since UI:R requires a victim to interact — reducing the population of reachable authenticated users lowers exposure.
• Deploy WAF rules targeting script-injection tokens against the CLM/Wage Determination URL scheme, based on the detection guidance above. WAF is a compensating control only, not a fix.
• Email/URL filtering to reduce attacker ability to induce the required user interaction (UI:R) — block or rewrite suspicious links pointing at EBS CLM endpoints.

2) Patch / Upgrade Steps

• Monitor the Oracle Critical Patch Update (CPU) and Oracle Security Alerts feeds for the release that addresses CVE-2026-87169. Oracle publishes E-Business Suite fixes through its quarterly CPU cycle.
• Once the fixing CPU is published, upgrade Oracle EBS to the version level that includes the fix for the affected CLM for Public Sector component (verify the specific CVE against the CPU advisory — do not assume coverage).
• Until a fix is confirmed, validate whether the CLM for Public Sector module is actually required; if not, consider disabling/unexposing the Wage Determination Online component to shrink attack surface.

3) Long-Term Hardening

• Maintain asset inventory of all EBS deployments and their version (12.2.3–12.2.15 affected), and track EBS instances in a vulnerability management program with the CPU cycle as a scheduled input.
• Adopt defense-in-depth for the web tier: positive-security input validation, output encoding (per OWASP guidance for the client-side injection class), CSP headers, and Subresource Integrity to blunt S:C scope-change impact.
• Integrate the detection rules in this report into SOC monitoring, and periodically review EPSS/CISA KEV updates for changing exploitation likelihood.

References

1. NVD — CVE-2026-87169 detail page: https://nvd.nist.gov/vuln/detail/CVE-2026-87169
2. Oracle Critical Patch Updates and Security Alerts (vendor advisory channel for E-Business Suite): https://www.oracle.com/security-alerts/
3. FIRST EPSS — score lookup for CVE-2026-87169: https://api.first.org/data/v1/epss?cve=CVE-2026-87169
4. CISA Known Exploited Vulnerabilities Catalog (current status: not listed — monitor for change): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / in-the-wild evidence: None observed. No public PoC, exploit code, or Nuclei template exists for CVE-2026-87169 at time of writing; CISA KEV status is negative. Exploitation is currently modeled at low probability (EPSS 0.00253). All detection content in this report targets the vulnerability class given the absence of vendor-disclosed technical specifics.