Oracle Purchasing CVE-2026-87168

Exploitation requires the attacker to hold a valid low-privilege Oracle E-Business Suite account (PR:L) with network HTTP access to the Oracle Purchasing G-Invoicing component; it is not remotely reachable by fully unauthenticated actors despite the 'Authentication Bypass' tag. The affected deployment must be Oracle Purchasing version 12.2.10 through 12.2.15 with the G-Invoicing component in use (G-Invoicing is a U.S. federal intragovernmental buy/sell invoicing feature, so the practical target population skews toward government and federal-contractor EBS deployments). No user interaction is required (UI:N) and attack complexity is low (AC:L). The key limiting factors are the authenticated-account prerequisite and the module-specific exposure.

This is a genuine, well-calibrated high-severity vulnerability but not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) is internally consistent with the description: network-reachable over HTTP, low attack complexity, and low-but-non-zero privileges required - meaning the attacker must hold a valid, low-privilege Oracle E-Business Suite account. The 8.1 score (rather than 9.8) is correctly held down by two honest factors: PR:L (authentication is required, not bypassed) and A:N (no availability impact - the flaw compromises data confidentiality and integrity only). No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The 'Authentication Bypass' tag in the metadata directly contradicts the CVSS vector: PR:L means the attacker is authenticated, so this is a privilege-scoped data-compromise flaw, NOT an auth bypass - treat the tag as an error, not a signal of pre-auth risk. Net: prioritize patching for organizations running the affected G-Invoicing component, but the PR:L gate and absence of active-exploitation evidence make this a scheduled-remediation item rather than a drop-everything zero-day. Oracle's advisory (cspusep2026) provides no technical detail, so root cause (CWE N/A) cannot be independently verified.

An attacker with a low-privilege but valid Oracle E-Business Suite account sends crafted HTTP requests to the Oracle Purchasing G-Invoicing component, exploiting missing authorization checks to read, create, delete, or modify purchasing data beyond their intended access level. Because the attack is network-based with low complexity and no user interaction, a compromised or malicious internal user (or an outside attacker who has phished a low-tier credential) could exfiltrate or tamper with all Purchasing-accessible data. No public exploit code is identified at the time of analysis.