Description

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Purchasing executes to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-18T21:17:33.823Z",
  "pubdate": "2026-08-18T21:17:33.823Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Internal Operations component of the Oracle Purchasing product in Oracle E-Business Suite versions 12.2.3 through 12.2.15. This security flaw enables a low-privileged authenticated attacker with local access to the underlying infrastructure where Oracle Purchasing executes to compromise the application entirely. Successful exploitation of this vulnerability results in a complete takeover of the Oracle Purchasing product, impacting confidentiality, integrity, and availability with a CVSS 3.1 Base Score of 7.8.\nThe attack requires local access to the host infrastructure and low privileges, but does not require user interaction. The risk implications are severe, as an adversary capable of executing this attack can achieve full administrative control over the targeted product instance, potentially leading to broader system compromise depending on environmental isolation and access controls. Organizations running affected versions of Oracle E-Business Suite must prioritize applying vendor-supplied updates or implementing compensating controls to mitigate the risk of local privilege escalation and subsequent application takeover.",
  "technicalDetails": "The vulnerability resides in the Internal Operations component of Oracle Purchasing, part of the Oracle E-Business Suite product suite, specifically affecting supported versions 12.2.3 through 12.2.15. The flaw stems from insufficient access controls, insecure handling of internal operations, or improper authorization enforcement within the execution environment of the application.\nExploitation of this vulnerability requires a low-privileged attacker to have prior logon access to the operating system infrastructure where Oracle Purchasing processes and executes. Because the attack vector is local (AV:L), network exposure is not strictly required for the initial vector, though the attacker must be capable of executing localized commands or interacting directly with the underlying infrastructure's execution context. The attack complexity is low (AC:L), and no user interaction (UI:N) is required for successful exploitation.\nThe attack flow proceeds as follows: First, the low-privileged user establishes a valid logon session on the infrastructure hosting Oracle Purchasing. Second, leveraging local privileges and the insecure operational handling within the Internal Operations component, the attacker interacts with vulnerable execution routines or shared resources. Third, the attacker supplies a crafted payload or triggers unintended operational logic that bypasses boundary enforcement mechanisms. Finally, the execution flow grants the attacker elevated capabilities, resulting in the total compromise and takeover of the Oracle Purchasing product.\nThe post-exploitation impact encompasses a complete loss of CIA triads for the affected product. The attacker achieves full administrative control (High impact across Confidentiality, Integrity, and Availability), allowing unauthorized data access, modification of purchasing transactions, and disruption of core business operations managed by Oracle Purchasing."
}