Internet Procurement Connector
Monthly
Oracle Internet Procurement Connector in E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated network attackers to fully compromise data confidentiality and integrity within the connector via HTTP. Tagged as an authentication bypass by ENISA EUVD (EUVD-2026-61766), the flaw enables unauthorized creation, modification, deletion, and exfiltration of all connector-accessible data with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own characterization as 'easily exploitable' combined with low attack complexity and network accessibility make this a credible remediation priority for organizations running Oracle E-Business Suite.
Oracle Internet Procurement Connector in E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated network attackers to fully compromise data confidentiality and integrity within the connector via HTTP. Tagged as an authentication bypass by ENISA EUVD (EUVD-2026-61766), the flaw enables unauthorized creation, modification, deletion, and exfiltration of all connector-accessible data with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own characterization as 'easily exploitable' combined with low attack complexity and network accessibility make this a credible remediation priority for organizations running Oracle E-Business Suite.