Oracle Purchasing EUVD-2026-61895

Exploitation requires a valid low-privileged account (PR:L) with network access to the Oracle EBS Purchasing module over HTTP. The description characterizes the vulnerability as 'easily exploitable,' with no special configuration, no user interaction, and low attack complexity - meaning exploitation is reliable against any standard deployment of affected versions 12.2.3-12.2.15. The primary limiting factor is the requirement for a pre-existing authenticated session (PR:L), which rules out unauthenticated internet-facing exploitation; attackers must possess or obtain valid Oracle EBS credentials at any privilege level. Scope is unchanged (S:U), indicating exploitation does not pivot to other system components beyond Oracle Purchasing itself. No platform-specific or non-default configuration requirement was identified in the available data.

The CVSS 3.1 score of 8.8 is supported by a vector that combines network reachability (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), and no user interaction (UI:N) - a combination that enables reliable, repeatable exploitation with minimal attacker capability. The full C:H/I:H/A:H impact triad signals complete application takeover, not partial information disclosure despite the 'Information Disclosure' tag in the source data, which appears to understate the described impact. No EPSS data was provided, but the AC:L/PR:L combination typically correlates with elevated exploitation probability. There is no current CISA KEV listing and no confirmed public proof-of-concept, which moderates immediate urgency somewhat; however, the low exploitation barrier means that even a mid-sized municipal IT team in ustka managing an Oracle EBS deployment should treat this as urgent rather than deferring until the next maintenance window. Active exploitation has not been confirmed, but the straightforward attack path and broad version range (12.2.3-12.2.15) create meaningful exposure for any unpatched Oracle EBS environment.

An attacker with a valid low-privileged Oracle EBS account - such as a vendor portal user or a compromised internal employee credential - sends a crafted HTTP request to the Oracle Purchasing module's network-exposed endpoints. Due to low attack complexity and no user interaction requirement, the attacker can reliably trigger the underlying vulnerability to achieve full application takeover, including reading sensitive procurement data, modifying purchase orders, or disrupting availability. No public proof-of-concept exploit has been identified at time of analysis, but the straightforward CVSS vector suggests exploitation would not require specialized tooling.