Oracle Purchasing CVE-2026-91511

Exploitation targets the Internal Operations component of Oracle Purchasing within Oracle E-Business Suite versions 12.2.3 through 12.2.15, reachable remotely over HTTP. The attacker MUST hold a valid low-privileged account on the EBS instance (CVSS PR:L) - this is not a pre-authentication flaw despite the 'Authentication Bypass' tag. Exploitation is further LIMITED by high attack complexity (AC:H): Oracle characterizes it as 'difficult to exploit,' implying specific conditions or timing beyond a single request must be met. No end-user interaction is required (UI:N). The scope change (S:C) means a successful attack can impact other Oracle products beyond Purchasing, so defenders should assume blast radius extends across the EBS deployment.

This is a genuinely moderate-priority issue rather than a drop-everything emergency, and the signals are largely consistent. The CVSS 3.1 base score of 7.1 is driven by high confidentiality impact (C:H) and a scope change (S:C), but two metrics temper real-world risk: AC:H (high attack complexity, i.e. Oracle's own 'difficult to exploit' language) and PR:L (the attacker must already hold a low-privileged, authenticated account on the EBS instance). No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or imminent exploitation - consistent with a newly disclosed Oracle Critical Patch Update item. The most important caveat: the input Tags label this 'Authentication Bypass,' which directly conflicts with the CVSS vector's PR:L (an attacker must authenticate). Treat the authentication-bypass characterization as unverified/likely mislabeled and rely on the vector, which indicates a privileged-user escalation/data-exposure flaw, not a pre-auth bypass. Net: real priority for internet-facing EBS 12.2.x deployments where many users hold accounts, but the AC:H + PR:L combination makes mass, trivial exploitation unlikely.

A low-privileged but authenticated Oracle E-Business Suite user (or an attacker who has phished/obtained such credentials) sends crafted HTTP requests to the Oracle Purchasing 'Internal Operations' component and, after meeting the difficult-to-exploit conditions, reads critical data across a scope boundary into other EBS products. No public exploit code is identified at time of analysis, and the high attack complexity means exploitation requires specific conditions rather than a single trivial request.