Oracle Purchasing CVE-2026-101557

Exploitation requires an authenticated, low-privileged account on the affected Oracle E-Business Suite instance (CVSS PR:L) with network HTTP access to the Oracle Purchasing 'Internal Operations' component; affected versions are EBS/Purchasing 12.2.3 through 12.2.15. No user interaction is needed (UI:N) and complexity is low (AC:L), so any valid low-level user session is sufficient - the primary limiting factors are the need for valid authentication and network reachability of the Purchasing module. The specific configuration or request feature that triggers the flaw is not disclosed in the available data (Oracle typically withholds exploit detail in CPU advisories). Patched instances running the October 2026 CPU are not exposed.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable exploitation over HTTP with low attack complexity, only low-level privileges required, no user interaction, and full compromise of confidentiality, integrity and availability - described by Oracle as 'takeover of Oracle Purchasing.' Oracle's own classification as 'easily exploitable' reinforces the AC:L/PR:L rating. However, several enrichment signals are absent: there is no EPSS exploitation-probability score provided, the vulnerability is NOT in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active or at-scale exploitation at time of analysis. The signals are therefore internally consistent but one-dimensional: severity is vendor-confirmed and high, while real-world exploitation telemetry is simply missing rather than conflicting. One notable metadata discrepancy exists - the input Tags label this 'Information Disclosure,' yet the description and CVSS (C:H/I:H/A:H, 'takeover') indicate full compromise well beyond disclosure; treat the tag as understating impact. Oracle E-Business Suite is a high-value ERP target historically favored for post-authentication lateral movement and data theft, so defenders running affected EBS instances should prioritize the October 2026 CPU patch despite the lack of a published exploit.

An attacker who holds a low-privileged valid Oracle E-Business Suite account (or obtains one via another EBS flaw) sends crafted HTTP requests to the Internal Operations component of Oracle Purchasing. Because the flaw is low-complexity and needs no user interaction, successful exploitation yields full read/write control and effective takeover of the Purchasing module and its data. No public proof-of-concept is currently referenced, so exploitation would require independent development against the patched October 2026 CPU details.