EUVD-2026-61749
GHSA-ppw9-jh6x-2gm6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector and low-privilege OS logon requirement are consistent with the description; full C/I/A impact reflects Oracle's explicit 'takeover' characterization with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Purchasing executes to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Oracle Purchasing within E-Business Suite versions 12.2.3 through 12.2.15 exposes a local privilege escalation in the Internal Operations component that yields full application takeover. A low-privileged attacker with OS-level logon to the infrastructure running Oracle Purchasing can exploit this flaw without any additional complexity or user interaction, achieving complete confidentiality, integrity, and availability compromise of the Purchasing module. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local OS-level logon access (AV:L) to the server where Oracle Purchasing executes - the attacker must have an interactive or programmatic session on the EBS application tier host, not merely network connectivity to the application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local attack vector with low complexity, low privilege requirements, and no user interaction needed - all pointing to a highly reliable exploit path once an attacker has established any OS-level foothold on the EBS host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patches distributed in Oracle's Critical Patch Update for August 2026, referenced at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle E-Business Suite instances and identify deployments running versions 12.2.3 through 12.2.15. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Purchasing
View allFull takeover of Oracle Purchasing within Oracle E-Business Suite is achievable by any low-privileged, network-authentic
Oracle Purchasing versions 12.2.5 through 12.2.15 within Oracle E-Business Suite expose an authorization bypass flaw in
Oracle Purchasing (E-Business Suite component: Internal Operations), versions 12.2.3 through 12.2.15, exposes critical d
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Endeca). Rated high severity (CVSS
Unauthenticated HTTP access to Oracle Purchasing (a component of Oracle E-Business Suite versions 12.2.3-12.2.15) enable
Oracle Purchasing, a procurement module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-sever
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). Rated medium severity
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today