Description

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T21:17:53.050Z",
  "pubdate": "2026-08-18T21:17:53.050Z",
  "executiveSummary": "A remotely exploitable vulnerability has been identified within the Oracle Purchasing component of Oracle E-Business Suite, specifically affecting supported versions 12.2.3 through 12.2.15. This security flaw allows a low-privileged authenticated attacker with network access via HTTP to compromise the affected product entirely, leading to a complete system takeover. The vulnerability carries a CVSS 3.1 Base Score of 8.8, reflecting high severity impacts across confidentiality, integrity, and availability. The attack vector is network-based, requiring low attack complexity and low privileges, while user interaction is not required. Successful exploitation grants the adversary the capability to manipulate application data, execute unauthorized administrative actions, and fully compromise the targeted Oracle Purchasing instance, presenting severe risk implications for enterprise operations relying on the Oracle E-Business Suite framework.",
  "technicalDetails": "The vulnerability resides in the Oracle Purchasing component of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. The root cause stems from insufficient input validation, authorization checks, or improper access control mechanisms within the application logic, categorized under a general 'Other issue' classification. The vulnerability is exposed over the network via the HTTP protocol, allowing remote threat actors to interact directly with vulnerable endpoints.\nExploitation of this vulnerability requires the attacker to possess low-level privileges within the application environment. Despite the authentication requirement, the flaw enables a malicious actor to bypass intended security boundaries. The attack flow begins when the adversary crafts a malicious HTTP request targeting the vulnerable Oracle Purchasing component. Because validation checks are inadequate or missing, the application processes the malformed input or unauthorized command sequence.\nUpon successful execution of the payload, the attacker can leverage the compromised context to escalate privileges, manipulate underlying business logic, and achieve a full takeover of the Oracle Purchasing module. The resulting post-exploitation impact spans the complete CIA triad, granting the adversary high confidentiality impact (unauthorized access to sensitive procurement data), high integrity impact (modification or corruption of purchasing records and system configurations), and high availability impact (potential denial of service or disruption of core supply chain functions). The low attack complexity ensures that the exploit can be reliably executed without requiring complex race conditions or advanced situational prerequisites."
}