This vulnerability affects Oracle Purchasing in Oracle E-Business Suite versions 12.2.10 to 12.2.15. It is easily exploitable by an attacker with low privileges and network access via HTTP. The vulnerability can lead to unauthorized access to critical data or full access to all Oracle Purchasing accessible data. The scope of impact may extend beyond Oracle Purchasing to other products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no impact on integrity or availability. Oracle has released a Critical Security Patch Update in September 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the patches promptly to mitigate risk.

The vulnerability allows unauthorized access to critical data within Oracle Purchasing and potentially other related products due to scope change. It compromises confidentiality but does not affect integrity or availability. Attackers with low privileges and network access can exploit this vulnerability without user interaction, making it a significant risk for data exposure.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patches from Oracle without delay to remediate the issue. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed as available via Oracle's Critical Security Patch Update advisory.