Oracle Purchasing CVE-2026-101845

Exploitation requires an authenticated low-privileged account on Oracle Purchasing and network access via HTTP to the Internal Operations component; it affects Oracle Purchasing versions 12.2.3 through 12.2.15. The CVSS vector's high attack complexity (AC:H) indicates the attacker must satisfy additional conditions beyond simple credentialed access (e.g., specific state, timing, or non-default preconditions that Oracle does not detail), which meaningfully limits reliable exploitation. No user interaction is required (UI:N), but the mandatory valid credentials (PR:L) and AC:H substantially reduce realistic risk versus an unauthenticated flaw, and impact is confined to unauthorized modification of only some accessible data with no confidentiality or availability effect.

This is a genuinely low-priority vulnerability. The CVSS 3.1 base score of 3.1 is driven solely by a limited integrity impact (I:L; C:N, A:N) and is further constrained by high attack complexity (AC:H) and a requirement for existing low-level privileges (PR:L). While the attack vector is network-based over HTTP (AV:N), the combination of AC:H and PR:L means an attacker must already possess valid Oracle Purchasing credentials and overcome non-trivial conditions to achieve only partial, unauthorized modification of some accessible data. No EPSS score was provided in the input, so exploitation probability cannot be quantified; it is UNKNOWN rather than low. The CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no public exploit identified at time of analysis. All signals are consistent with each other: low CVSS, difficult exploitation, authenticated-only access, and no evidence of real-world weaponization. This is a high-CVSS-is-NOT-the-problem case - it is a low-CVSS, low-real-risk issue that should be remediated during routine Oracle Critical Patch Update cycles rather than treated as an emergency. One data note: the input Tags include 'Authentication Bypass,' which conflicts with the CVSS vector (PR:L requires authentication), so that tag appears mislabeled - verify against the Oracle advisory.

An attacker who already holds a low-privileged Oracle Purchasing account sends crafted HTTP requests to the Internal Operations component and, after satisfying difficult exploitation conditions, gains the ability to make unauthorized updates, inserts, or deletes to a subset of Purchasing data. No public exploit code is identified, and the high attack complexity (AC:H) means exploitation is not trivial or reliably repeatable.