This vulnerability affects Oracle Purchasing in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is an easily exploitable flaw that permits unauthenticated attackers with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data within Oracle Purchasing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack requires no privileges or user interaction, has low attack complexity, and impacts confidentiality with a high severity score of 7.5. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update advisory, which includes numerous security patches for Oracle products.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible through Oracle Purchasing, compromising confidentiality. There is no impact on integrity or availability reported. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of exposure.

Oracle has released security patches for this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.