This vulnerability in Oracle Purchasing (component: G-Invoicing) allows a low privileged attacker with network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Purchasing. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The affected versions are 12.2.11 through 12.2.15 inclusive. Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available patches promptly to mitigate risk.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Purchasing, or unauthorized access to all data accessible by Oracle Purchasing. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability is easily exploitable by an attacker with low privileges and network access via HTTP.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the security patches provided in this update without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.