Oracle Purchasing CVE-2026-70947

No special conditions are required beyond network-level HTTP access to an Oracle E-Business Suite instance running a Purchasing component version between 12.2.3 and 12.2.15. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against default configurations of Oracle Purchasing - no specific feature flag, non-default setting, or prior authentication is required. Exploitation is constrained to confidentiality impact only (C:H/I:N/A:N); the attacker cannot modify data or cause denial of service through this vulnerability. The version scope (12.2.3-12.2.15) limits exposure to organizations that have not yet applied the August 2026 CPU. Organizations with Oracle EBS HTTP access restricted to trusted internal networks via firewall or network segmentation have meaningfully reduced but not eliminated risk.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) presents a high-priority signal: fully remote, unauthenticated, low-complexity exploitation with no user interaction required. The authentication bypass tag reinforces that this is a structural access control failure rather than a narrow edge-case requiring unusual configuration. Confidentiality impact is high - Oracle Purchasing data can include vendor pricing, contractual terms, procurement strategies, and financial commitments, making this a meaningful business espionage risk. EPSS data was not provided in the input, limiting probabilistic exploitation forecasting. The vulnerability is not currently listed in CISA KEV, and no public POC has been identified, which moderates the urgency slightly compared to confirmed in-the-wild exploitation. However, the combination of zero prerequisites and network accessibility means this could be trivially automated against exposed EBS instances by any attacker who identifies the target. Organizations with Oracle EBS Purchasing exposed to untrusted networks should treat this as a priority patch.

An attacker with network-level HTTP access to an Oracle E-Business Suite instance sends crafted HTTP requests to the Oracle Purchasing component, bypassing authentication controls due to the structural flaw. Without supplying any credentials, the attacker retrieves sensitive procurement records - purchase orders, vendor pricing, approval histories - potentially enabling competitive intelligence gathering or fraud enablement. No public POC has been identified, but the low attack complexity (AC:L) and zero authentication requirement suggest exploitation is structurally straightforward for an attacker who has identified the endpoint.