Main Vulnerability Database Vulnerabilities #VU162122

Improper input validation in Oracle E-Business Suite and Oracle Contract Lifecycle Management for Public Sector - CVE-2026-87169

Published: November 8, 2026

Vulnerability identifier: #VU162122

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-87169

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Wage Determination Online component in Oracle Contract Lifecycle Management for Public Sector in Oracle E-Business Suite. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Affected software

Oracle E-Business Suite
Oracle Contract Lifecycle Management for Public Sector

How to mitigate CVE-2026-87169

Install updates from vendor's website.

External References

https://www.oracle.com/security-alerts/cspusep2026.html

Related Security Bulletins