Threats affecting pkg:maven/com.oracle.ebusinesssuite/purchasing

A vulnerability exists in the Oracle Purchasing product of Oracle E-Business Suite versions 12.2.3 through 12.2.15. This flaw allows a low-privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical data within Oracle Purchasing. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with significant confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

A high-severity vulnerability exists in the Oracle Purchasing product of Oracle E-Business Suite, specifically in the G-Invoicing component. The flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data within Oracle Purchasing. The vulnerability affects supported versions 12.2.11 through 12.2.15 and has a CVSS 3.1 base score of 8.1, indicating high confidentiality and integrity impact without availability impact.