This vulnerability in Oracle Purchasing (Oracle E-Business Suite) allows an attacker with low privileges and network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data, or gain unauthorized access to all data accessible by Oracle Purchasing. The affected versions are 12.2.3 through 12.2.15 inclusive. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability. No known exploits in the wild have been reported to date.

The vulnerability allows unauthorized creation, deletion, or modification of critical data within Oracle Purchasing, as well as unauthorized access to all data accessible by the application. This can lead to significant confidentiality and integrity breaches, potentially compromising business operations dependent on Oracle Purchasing data. Availability is not impacted according to the CVSS vector.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the relevant patches for Oracle Purchasing versions 12.2.3 through 12.2.15 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or temporary fixes are indicated in the advisory.