CVE-2026-91511 is a vulnerability in Oracle Purchasing within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data accessible by Oracle Purchasing. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with significant confidentiality and integrity impacts. Oracle has released patches addressing this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.
CVE-2026-101846 is a vulnerability in Oracle Purchasing component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. Exploitation requires user interaction from someone other than the attacker. The CVSS 3.1 base score is 3.5, indicating a low severity primarily impacting data integrity.
CVE-2026-101845 is a vulnerability in Oracle Purchasing within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible Oracle Purchasing data. The vulnerability is rated with a low CVSS score of 3.1, indicating limited impact primarily on data integrity. Exploitation is considered difficult due to the required conditions and attack complexity.
CVE-2026-101559 is a vulnerability in Oracle Purchasing component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle Purchasing. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-101558 is a vulnerability in Oracle Purchasing component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Purchasing, requiring user interaction from a person other than the attacker. Successful exploitation can lead to unauthorized update, insert, or delete access to some Oracle Purchasing data, as well as unauthorized read access to a subset of this data. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with confidentiality and integrity impacts. The vulnerability may also impact additional products due to scope change. Oracle has released patches for this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.10-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.11-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.10-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. While the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVE-2026-70947 is a vulnerability in Oracle Purchasing, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or potentially all data accessible through Oracle Purchasing. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a high severity with a significant confidentiality impact. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update, which provides targeted security fixes across multiple Oracle products.
CVE-2026-70811 is a high-severity vulnerability in Oracle Purchasing, part of the Oracle E-Business Suite. It affects versions 12.2.5 through 12.2.15. The flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical data within Oracle Purchasing. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality and integrity. Oracle has published a Critical Security Patch Update advisory addressing multiple vulnerabilities, including this one, and strongly recommends applying patches promptly.
CVE-2026-70798 is a vulnerability in Oracle Purchasing, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with logon access to the infrastructure where Oracle Purchasing runs to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-70797 is a vulnerability in Oracle Purchasing, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to compromise Oracle Purchasing, potentially leading to full takeover of the product. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update, which provides patches for affected versions.
CVE-2026-62491 is a high-severity vulnerability in Oracle Purchasing, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low-privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data within Oracle Purchasing. The vulnerability impacts confidentiality and integrity but does not affect availability. Oracle has published a Critical Security Patch Update advisory addressing this and many other vulnerabilities.
CVE-2026-62493 is a vulnerability in Oracle Purchasing component of Oracle E-Business Suite versions 12.2.11 through 12.2.15. It allows a low privileged attacker with network access via HTTP to potentially compromise Oracle Purchasing. The vulnerability is difficult to exploit but can lead to full takeover of the Oracle Purchasing application. The CVSS 3.1 base score is 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has published a Critical Patch Update advisory in July 2026 addressing this and many other vulnerabilities.