This vulnerability affects Oracle Purchasing in Oracle E-Business Suite versions 12.2.5 to 12.2.15. It permits a low privileged attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data within Oracle Purchasing. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory references Oracle's August 2026 Critical Security Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Purchasing. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability is exploitable remotely over the network with low privileges required.

Oracle's advisory strongly recommends that customers remain on actively supported versions and apply security patches without delay. However, the specific patch or remediation for this vulnerability is not explicitly confirmed in the advisory content provided. Users should consult the Oracle Critical Security Patch Update for August 2026 and apply relevant patches as soon as they become available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.