If current version is 8.7.SP1.Patch2,

1. Update to AM 8.7 SP2 – primary first, then replicas 1 at a time. Check replication status when done with last replica. Make sure Status = good
2. Update to AM 8.8 – primary first, then replicas... you can jump to AM 8.9 update Step 5 from here.
3. Consider update to AM 8.8 P3 - primary first,,,
4. Consider update to AM 8.8 P3 Hot fix 2 for
5. Update to AM 8.9 - primary first, then replicas...
6. Plan to Update to 8.9 Patch 1 – primary first, then replicas by the end of March

 AM 8.9 P1 will include Oracle Web Logic Jan2026CPU and include Hot Fix 2 for P3 of AM 8.8.

8.8 P3 HF2 addresses the following CVEs

CVE-2013-7285, CVE-2021-21342, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21350, CVE-2021-21351

Do you need to worry about the 8.7 SP2 P1 through P3?

Documentation says No, latest patch rolls up earlier patches.