EUVD-2026-105969
GHSA-q9g2-qg48-9848
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS account
-
ExploitSend crafted HTTP request to PO View Document
-
ExecutionBypass data access controls
-
ImpactRead unauthorized Oracle Purchasing data
Vulnerability Assessment
| Exploitation Conditions | Requires an authenticated low-privilege account on an Oracle E-Business Suite instance running Oracle Purchasing versions 12.2.3 through 12.2.15, with the PO View Document component reachable over HTTP. Limiting factors: exploitation is not possible for fully unauthenticated attackers (PR:L), so the EBS login surface must be reachable by the attacker; impact is confined to confidentiality (reading Oracle Purchasing data) with no integrity or availability effect. No special non-default configuration is called out in the description beyond having the Purchasing module deployed. |
| Impact | This is a moderate-priority, not top-tier, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity attack requiring low-level privileges (PR:L) and no user interaction, impacting confidentiality only (C:H, I:N, A:N) - i.e. data disclosure, not code execution or integrity/availability loss. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or imminent widespread exploitation; by the precision rules this is 'no public exploit identified at time of analysis.' The 'Authentication Bypass' tag conflicts with the vector: PR:L explicitly requires an authenticated low-privilege account, so this is a privilege/data-exposure flaw, not a true auth bypass - treat the tag as suspect. Net: a genuinely exploitable but confidentiality-only flaw in a high-value ERP product, worth prioritizing for Oracle EBS operators during the October 2026 CPU cycle but below the urgency of a KEV-listed or RCE-class bug. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Oracle Purchasing 'PO View Document' component. Because exploitation is network-based, low-complexity, and needs no user interaction, the attacker reads purchasing data they should not have access to, potentially up to all Oracle Purchasing-accessible data. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle Purchasing 12.2.3 through 12.2.15 within Oracle E-Business Suite can expose critical purchasing data to a low-privileged authenticated user who can reach the PO View Document component over HTTP, yielding a confidentiality-only CVSS 3.1 score of 6.5. Exploitation requires a valid EBS account (PR:L) and no user interaction; the impact is limited to reading Oracle Purchasing data, with no integrity or availability effect. No public exploit or CISA KEV entry is identified at time of analysis, so this is a moderate-priority patching item rather than an actively exploited emergency.
RemediationAI
Patch availability is not confirmed with an exact fixed version in the provided data; consult and apply the relevant Oracle E-Business Suite Purchasing fix from the Oracle October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html) after validating the target version. Until patched, reduce exposure by restricting network access to the EBS HTTP login and Purchasing/PO View Document endpoints to trusted users or networks, removing unnecessary Purchasing responsibilities and dormant low-privilege accounts, and monitoring for anomalous PO View Document access; these controls have operational trade-offs because they can block legitimate remote users and reduce business functionality. Because exploitation requires an authenticated low-privilege account (PR:L), enforcing MFA and least privilege on EBS accounts is a practical compensating control, though it does not fix the underlying data-exposure issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue resides in Oracle E-Business Suite's Oracle Purchasing module, specifically the PO View Document component, which is reachable over HTTP. No CWE is assigned in the supplied data; functionally the CVSS vector describes an access-control/data-exposure weakness in which a low-privileged session can retrieve data beyond its intended scope (C:H with I:N/A:N). The reporting tags include Authentication Bypass, but the authoritative vector uses PR:L, so the behavior should not be treated as an unauthenticated bypass: the attacker must already hold a valid low-privilege EBS account and network reachability to the Purchasing/PO View Document surface. The Oracle October 2026 Critical Patch Update is the vendor advisory reference.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network HTTP access with low complexity and no user interaction, but a low-privilege account is required (PR:L); impact is confidentiality-only, so I:N and A:N.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: PO View Document). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB