Improper input validation in Oracle Contract Lifecycle Management for Public Sector - CVE-2026-87165
Published: November 8, 2026
Vulnerability identifier: #VU161979
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-87165
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to execute arbitrary code.
The vulnerability exists due to improper input validation within the ECC For Award and IDV component in Oracle Contract Lifecycle Management for Public Sector in Oracle E-Business Suite. A remote authenticated user can exploit this vulnerability to execute arbitrary code.
Affected software
Oracle Contract Lifecycle Management for Public Sector
How to mitigate CVE-2026-87165
Install updates from vendor's website.