EUVD-2026-106244
GHSA-8c4c-g3c5-pjch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged EBS user
-
DeliveryCraft malicious HTTP request/link
-
ExploitDeliver to higher-privileged victim
-
ExecutionVictim interaction triggers flaw
-
ImpactUnauthorized modification of Purchasing data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must hold valid low-privileged credentials on Oracle Purchasing (PR:L) and reach it over HTTP (AV:N). Exploitation additionally requires human interaction from a different, typically higher-privileged user (UI:R) - the attack cannot complete unattended. Affected deployments are Oracle Purchasing versions 12.2.3 through 12.2.15 (Internal Operations component). The need for both prior authentication and victim interaction, combined with impact limited to partial, unauthorized modification of a subset of Purchasing data (no read access, no availability loss), substantially constrains realistic exploitation. |
| Impact | This is a genuinely low-priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, base 3.5) shows the limiting factors clearly: the attacker must already hold low-level privileges (PR:L) on Oracle Purchasing, must lure a separate victim into interacting (UI:R), and the only impact is a limited, partial integrity effect (I:L) - no confidentiality or availability loss. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of exploitation activity; per the available signals this is 'no public exploit identified at time of analysis.' The signals are internally consistent - nothing here contradicts the low score. One data-quality concern: the input carries an 'Authentication Bypass' tag, which conflicts with the vector (PR:L requires valid authentication, and the impact is a minor integrity change, not a bypass) and appears mislabeled. Net: a real but minor flaw, appropriately rated LOW, that does not warrant emergency patching but should be rolled into the normal Oracle CPU cycle. |
| Exploit ScenarioDerived | A low-privileged Oracle Purchasing user crafts a malicious link or request and tricks a more-privileged colleague into clicking it while authenticated to the EBS web interface. The forced interaction causes an unauthorized update, insert, or delete against a subset of Purchasing data. No public exploit code is known, and only partial integrity is affected - no data disclosure or service outage. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Integrity-only tampering in the Oracle Purchasing module of Oracle E-Business Suite (12.2.3 through 12.2.15) lets a low-privileged, authenticated user reach the Internal Operations component over HTTP and, if a separate and typically more privileged user is induced to interact, perform unauthorized updates, inserts, or deletes against a limited subset of Purchasing data. There is no confidentiality or availability impact and the CVSS 3.1 base score is 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N), so both prior authentication and victim interaction are prerequisites - no public exploit identified at time of analysis, and no CISA KEV listing. This is a genuinely low-priority issue despite being network-exploitable, and the practical risk is concentrated in environments where low-privileged Purchasing accounts are widely distributed or weakly governed.
RemediationAI
Patch available per vendor advisory - apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the only remediation reference supplied; the advisory does not publish a discrete fixed version number for this CVE, so confirm the exact Purchasing patch and prerequisite EBS patchset level (12.2.x) against that CPU before rollout, and treat 12.2.3-12.2.15 as in scope until patched. Where patching must be deferred, actionable compensating controls are: restrict network access to the EBS application tier so only intended corporate networks or VPN segments can reach Purchasing over HTTP (side effect: breaks legitimate remote/mobile procurement access and may require a reverse proxy or VPN expansion); audit and prune low-privileged Purchasing responsibilities and self-service accounts, since PR:L is a hard prerequisite (side effect: administrative cleanup effort and possible disruption to delegated buyers); enforce phishing-resistant MFA and user awareness around unsolicited Purchasing workflow approvals, because UI:R requires a second user to be induced into an action (side effect: none on the application, but it is a user-dependent control); and enable EBS audit/on-demand monitoring for anomalous inserts, updates, or deletes on Purchasing tables with alerting on changes made outside normal business workflows (side effect: additional audit storage and log review overhead). Because impact is integrity-only and bounded to a subset of Purchasing data, prioritizing this patch behind higher-CVSS Oracle CPU items is defensible provided the access restrictions above are in place.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle E-Business Suite is Oracle's long-standing ERP application stack; Oracle Purchasing is its procurement module, and the affected 'Internal Operations' component is the internal business-logic layer exposed through the EBS web listener over HTTP. Successful exploitation requires a valid low-privileged Purchasing session (PR:L in the vector), network reachability of the application tier (AV:N), low attack complexity, and a user-interaction step performed by a different - normally more privileged - account (UI:R), a pattern consistent with a state-changing operation that must be triggered or confirmed on behalf of another user rather than a directly reachable unauthenticated endpoint. No CWE identifier was published for this CVE, so the root cause cannot be attributed to a specific weakness class from source data; behaviorally the impact profile (unauthorized insert/update/delete with no read or availability effect) is most consistent with an access-control or business-logic authorization gap scoped to a narrow set of Purchasing operations, but that is an inference, not a vendor statement. Note that the supplied tags include 'Authentication Bypass', which conflicts with the authoritative CVSS vector requiring PR:L; the vector and independent assessment should be treated as correct, and the tag likely reflects generic advisory tagging rather than a bypass of authentication.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Network HTTP access with low attacker privileges (PR:L) and required third-party interaction (UI:R); only partial integrity impact, no confidentiality or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 3.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB