This vulnerability affects Oracle Purchasing versions 12.2.3 through 12.2.15 and allows an attacker with low privileges and network access via HTTP to compromise the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the attack can be performed remotely with low attack complexity and privileges, without user interaction, and results in high confidentiality, integrity, and availability impacts. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which provides targeted fixes for this and other vulnerabilities. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Purchasing, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the Oracle Purchasing component within Oracle E-Business Suite, potentially impacting business operations that rely on this product.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.