Description

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:35.657Z",
  "pubdate": "2026-08-18T21:17:35.657Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Internal Operations component of the Oracle Purchasing product in Oracle E-Business Suite versions 12.2.5 through 12.2.15. This security flaw enables a low-privileged authenticated attacker with network access via HTTP to compromise the application and achieve unauthorized read, write, and delete capabilities over critical enterprise data.\nThe vulnerability directly impacts both the confidentiality and integrity of the system by permitting unauthorized manipulation and extraction of all Oracle Purchasing accessible data. While the availability impact remains negligible, the potential for unauthorized data modification and disclosure poses severe governance, risk, and compliance implications for organizations relying on the affected E-Business Suite deployment.\nExploitation requires no user interaction and can be executed remotely over the network using standard HTTP protocols. The primary prerequisite is that the threat actor possesses low-privileged access to the application, allowing them to leverage legitimate operational pathways to bypass intended authorization boundaries within the Internal Operations module.",
  "technicalDetails": "The vulnerability resides within the Internal Operations component of Oracle Purchasing, an integral sub-system of Oracle E-Business Suite versions 12.2.5 to 12.2.15. The underlying root cause stems from insufficient authorization checks and access control enforcement within server-side request processing logic, allowing authenticated users to execute functions and access datasets exceeding their assigned privilege level.\nFrom an attack vector perspective, the vulnerability is exposed over the network via HTTP (AV:N), meaning no local system access or physical proximity is required. The attack complexity is classified as low (AC:L), indicating that exploitation does not require sophisticated race conditions, advanced cryptographic manipulation, or complex environmental preconditions. Furthermore, the attack requires low privileges (PR:L), necessitating that the threat actor has already provisioned or compromised a standard low-privileged user account within the Oracle E-Business Suite environment.\nThe step-by-step attack flow proceeds as follows: First, the low-privileged attacker establishes an HTTP session with the target Oracle E-Business Suite instance and authenticates using standard credentials. Second, the attacker crafts malicious HTTP requests targeting the vulnerable endpoints within the Internal Operations component of Oracle Purchasing. Third, due to inadequate input validation and missing access control validations, the application processes the request without verifying whether the requesting user possesses the requisite administrative or operational clearance. Finally, the server executes the requested data manipulation or retrieval routine, granting the attacker unauthorized access to read critical confidentiality data or perform unauthorized creation, deletion, and modification of data affecting system integrity.\nPost-exploitation impact includes full compromise of the confidentiality and integrity of all Oracle Purchasing accessible data. Because the exploit vector circumvents authorization controls, malicious actors can exfiltrate sensitive procurement records, inject fraudulent purchase orders, alter supplier agreements, or delete critical operational entries, leading to severe data corruption and compliance failures within the enterprise resource planning ecosystem."
}