This vulnerability exists in the Oracle Purchasing component of Oracle E-Business Suite versions 12.2.5 to 12.2.15. It permits a low-privileged attacker with network access via HTTP to compromise Oracle Purchasing, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through Oracle Purchasing. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 fixes and urges customers to apply patches without delay.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle Purchasing, or unauthorized access to all data accessible by Oracle Purchasing. This compromises confidentiality and integrity of sensitive business data managed by Oracle Purchasing. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant patches from this update promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.