Oracle Purchasing EUVD-2026-47523

Exploitation requires the attacker to already possess valid low-privilege credentials to Oracle E-Business Suite (CVSS PR:L) and network HTTP access to the Oracle Purchasing 'Internal Operations' component; it is not remotely reachable by a fully unauthenticated attacker. The affected deployment must be a supported EBS release in the 12.2.11 through 12.2.15 band. Exploitation is further limited by high attack complexity (AC:H), meaning specific conditions outside the attacker's control (timing, configuration, or environmental state) must be met, so reliable exploitation is non-trivial; no user interaction is required (UI:N). Oracle's advisory does not enumerate the exact configuration prerequisite behind AC:H, so the precise limiting condition is not confirmed from available data.

CVSS 3.1 is 7.5 (High) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - network-reachable and fully impactful, but tempered by high attack complexity (AC:H) and a low-privilege authentication requirement (PR:L), which meaningfully reduce real-world exploitability versus an unauthenticated, low-complexity flaw of the same score. There is no CISA KEV listing and no public exploit identified, and no EPSS value was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. On balance this is a legitimate patch-cycle priority for organizations running Oracle EBS 12.2.x - full application takeover is severe - but the AC:H + PR:L barrier means it is not a drop-everything emergency absent evidence of active exploitation. Note a minor signal conflict: the vendor tag says 'Information Disclosure' while the CVSS vector and description indicate full integrity and availability impact (takeover); treat the CVSS impact metrics as authoritative over the tag.

An attacker who already holds a low-privileged Oracle EBS account (for example a compromised internal or self-service supplier login) sends crafted HTTP requests to the Purchasing / Internal Operations component and, after overcoming the high-complexity conditions, escalates to full control of the Purchasing application, reading and altering procurement data. No public exploit is identified, so a working exploit would require the attacker to independently develop one against the AC:H conditions.