This vulnerability affects Oracle Purchasing component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low-privileged attacker with network access via HTTP to compromise Oracle Purchasing, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through Oracle Purchasing. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no availability impact. The vulnerability is identified as CWE-284 (Improper Access Control). Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 patches released. Customers are strongly advised to apply the patches promptly.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle Purchasing, or unauthorized access to all data accessible by Oracle Purchasing. This compromises confidentiality and integrity of sensitive business data but does not impact system availability. The vulnerability can be exploited remotely over the network via HTTP by an attacker with low privileges.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Customers should apply the relevant patches for Oracle Purchasing versions 12.2.3 through 12.2.15 without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security updates to prevent exploitation. No alternative mitigations or temporary fixes are indicated in the advisory.