Oracle Purchasing CVE-2026-62491

Exploitation requires a valid low-privileged account within the Oracle E-Business Suite instance - the CVSS PR:L vector confirms authentication is necessary. The attacker must have HTTP network access to the Oracle EBS application server (typically TCP 443 or 8443 for HTTPS, or 8000/8080 for HTTP). The vulnerability resides in the Internal Operations component of Oracle Purchasing and appears exploitable against standard deployments of affected versions (12.2.3-12.2.15) without requiring any non-default configuration. Exploitation is limited by: (1) the requirement for at least a low-privileged EBS account - fully unauthenticated exploitation is not supported by the PR:L vector; (2) network reachability to the EBS application tier, which in many enterprises is restricted behind a corporate perimeter or VPN; and (3) the vulnerability does not affect availability (A:N), limiting the denial-of-service risk. The 'Authentication Bypass' tag suggests the bypass operates at the authorization layer (role/permission enforcement), not at the login layer.

The CVSS 3.1 score of 8.1 (High) is driven by network reachability (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and dual High impacts on confidentiality and integrity (C:H/I:H) with no availability impact (A:N). These metrics are internally consistent with the description: an authenticated low-privilege user over HTTP can read all accessible purchasing data and tamper with critical records. The 'easily exploitable' language in the description reinforces AC:L. No EPSS score is provided in the available data, which limits probabilistic exploitation forecasting. No CISA KEV listing is confirmed, and no POC is referenced in the supplied intelligence, meaning exploitation in the wild is not confirmed - this reduces urgency compared to a KEV-listed vulnerability of similar CVSS. However, the Authentication Bypass tag and the broad affected version range (12.2.3-12.2.15, spanning 13 minor versions) significantly widen the potential attack surface across unpatched EBS environments. The absence of a CWE designation limits root-cause confidence. SSVC dimensions: Exploitation status is none (no confirmed active exploitation); Automatable is likely YES given AC:L and UI:N; Technical Impact is Total for confidentiality and integrity within the purchasing module. Net assessment: real and addressable priority - not a high-CVSS/low-real-risk outlier - but not an emergency requiring emergency change management in the absence of KEV or POC.

An attacker who holds any low-privileged account in Oracle E-Business Suite - such as a read-only procurement viewer or a newly onboarded supplier contact - sends a crafted HTTP request to the Internal Operations endpoint of the Oracle Purchasing module. Due to the authorization bypass flaw, the request succeeds despite the account lacking the required role, granting the attacker full read access to all purchasing data (supplier contracts, PO terms, financial commitments) and the ability to create, modify, or delete critical purchasing records. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and no user interaction requirement (UI:N) mean that exploitation would be straightforward to operationalize by a moderately skilled attacker with valid credentials.