Oracle Purchasing EUVD-2026-105968

Exploitation requires the Oracle Purchasing Approvals component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) to be network-reachable over HTTP, AND requires human interaction from a person other than the attacker (UI:R) - specifically a legitimate EBS user with access to the Approvals interface must be induced to interact with attacker-supplied content. The attacker themselves needs no authentication (PR:N), but the dependency on tricking an authenticated/authorized victim is the primary limiting factor, meaning social-engineering delivery (malicious link or page) is a prerequisite and purely automated mass exploitation is unlikely. The scope change (S:C) means successful attacks can reach additional EBS products beyond Purchasing.

This is a moderate-risk issue (CVSS 3.1 base 6.1, MEDIUM), not a drop-everything priority. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N shows network reach with low complexity and no privileges required, but exploitation is gated by UI:R - a victim with legitimate access must be tricked into an action. Impacts are limited (C:L/I:L, no availability), though the scope change (S:C) is the notable amplifier, indicating the flaw in Oracle Purchasing can affect additional Oracle E-Business Suite products beyond the vulnerable component. No EPSS score, KEV listing, POC, or SSVC data was provided, so there is no evidence of active exploitation or automatability: exploitation status is 'no public exploit identified at time of analysis.' The combination of PR:N + UI:R + S:C + partial C/I impacts is the classic signature of a reflected cross-site scripting / request-forgery style flaw, consistent with the Approvals web component - note that the input Tag 'Authentication Bypass' conflicts with this profile (the vector requires a victim's interaction, not a bypass of authentication) and appears mislabeled.

An attacker crafts a malicious link or page targeting the Oracle Purchasing Approvals interface and sends it to a legitimate EBS user (e.g., an approver). When that user, who is already authenticated to the application, interacts with the crafted content, the payload executes in their session context, enabling limited unauthorized read and modification of Purchasing data and potentially affecting other EBS products via the scope change. No public exploit code was identified at the time of analysis.