This vulnerability affects Oracle Purchasing versions 12.2.3 to 12.2.15 in the Oracle E-Business Suite. It is exploitable remotely over HTTP by an attacker with low privileges, allowing compromise and takeover of the Oracle Purchasing component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 fixes across multiple products. Oracle emphasizes the importance of applying these patches without delay to prevent exploitation.

Successful exploitation can lead to complete compromise of Oracle Purchasing, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected component, potentially disrupting business operations and exposing sensitive data.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed as available via the vendor advisory.