This vulnerability affects Oracle Purchasing in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable by an attacker with low privileges and network access over HTTP, enabling unauthorized manipulation and access to critical data within Oracle Purchasing. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability alongside hundreds of others, emphasizing the importance of timely patching.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data in Oracle Purchasing, as well as unauthorized access to all data accessible through Oracle Purchasing. This compromises confidentiality and integrity of sensitive business data, potentially affecting business operations and data trustworthiness. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as official-fix available via the vendor advisory at https://www.oracle.com/security-alerts/cspusep2026.html.