Oracle CLM Public Sector CVE-2026-87149

Exploitation requires a valid, authenticated Oracle E-Business Suite session holding only low privileges (CVSS PR:L) and network reachability to the EBS HTTP interface that serves the Contract Lifecycle Management for Public Sector product - specifically the Award/PO component. The deployment must be running an affected supported release, 12.2.8 through 12.2.15, with the CLM for Public Sector licensing/module actually implemented; organizations that have not deployed that module are not exposed even on the same EBS version. No user interaction is required (UI:N) and the attack is automatable over a single HTTP channel. Limiting factors: the attacker cannot start unauthenticated - a working low-privilege credential is a hard prerequisite, so account provisioning and credential hygiene directly bound the risk; and the integrity impact is only partial (I:L), meaning not all records are writable. The provided data does not specify whether any non-default configuration of the Award/PO component is required, so that should be confirmed with Oracle's advisory.

The CVSS vector is the strongest signal here: AV:N with AC:L and UI:N means a single crafted HTTP request, no timing or race conditions, and no victim interaction; PR:L restricts the attacker to an already-issued low-privilege account, which substantially narrows the realistic threat population to insiders, contractor accounts, or anyone who has obtained valid credentials (e.g., via phishing or credential reuse). Confidentiality impact is High while Integrity is Low and Availability None, so the primary risk is bulk disclosure of sensitive contract/award data with opportunistic tampering. There is no EPSS score, no CISA KEV listing, and no POC information in the supplied data, so the exploitation likelihood cannot be corroborated - this is a high-CVSS, medium-real-world-urgency finding rather than a burning emergency, unless the organization exposes the EBS web tier broadly or has many low-privilege accounts. Note explicitly: KEV status is unknown/absent, POC status is unknown, and no CWE was provided, so the root-cause class is inferred from the description rather than confirmed.

An attacker who has obtained or been granted a low-privileged Oracle E-Business Suite account - for example a subcontractor or a compromised user - logs in over HTTP and sends crafted requests directly to the Contract Lifecycle Management Award/PO endpoints, manipulating object/function identifiers to bypass the authorization check. Because no user interaction or elevated privilege is required, the attacker can enumerate and exfiltrate contract and award records in bulk, and can also insert, update or delete a subset of that data to corrupt or alter procurement records. The activity blends into normal EBS traffic, making it hard to distinguish without application-level audit logging.