Description

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T21:17:33.690Z",
  "pubdate": "2026-08-18T21:17:33.690Z",
  "executiveSummary": "A high-severity vulnerability affects the Oracle Purchasing product within Oracle E-Business Suite, specifically residing within the Internal Operations component. This security flaw enables a highly privileged attacker with network access via the HTTP protocol to compromise the affected application entirely. Successful exploitation of this vulnerability can result in the complete takeover of Oracle Purchasing, yielding severe consequences across confidentiality, integrity, and availability.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.2 with a vector of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Exploitation requires high privileges and network connectivity, but does not require user interaction and features low attack complexity. Affected supported software versions range from 12.2.3 through 12.2.15. Given the high-privileged access requirement, organizations must enforce strict access controls and principle of least privilege to mitigate the risk of lateral movement and complete system compromise.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of Oracle Purchasing, part of the Oracle E-Business Suite product architecture. The flaw allows an authenticated attacker holding high privileges to interact with vulnerable internal functions exposed over the network via the HTTP protocol.\nThe attack flow begins when an adversary with network accessibility and high-level administrative or privileged credentials sends a crafted HTTP request targeting the Internal Operations component. Due to insufficient input validation, authorization checks, or insecure deserialization within the vulnerable functions, the application processes the malicious payload without adequate restriction.\nUpon successful processing of the payload, the attacker can execute unauthorized actions within the context of the application. Because the affected component handles critical internal operational logic, compromising it grants the attacker extensive control over the Oracle Purchasing module. This leads directly to a full takeover of the target product, granting the attacker arbitrary capabilities affecting data confidentiality, system integrity, and service availability.\nThe attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring no user interaction (UI:N). However, exploitation strictly mandates high privileges (PR:H), meaning an attacker must first compromise or possess administrative credentials capable of interacting with the internal operations mechanisms. The scope remains unchanged (S:U), but the impact on confidentiality, integrity, and availability are all rated as high (C:H/I:H/A:H). The vulnerability impacts all supported Oracle E-Business Suite versions from 12.2.3 to 12.2.15."
}