Purchasing
Monthly
Full takeover of Oracle Purchasing within Oracle E-Business Suite is achievable by any low-privileged, network-authenticated attacker exploiting this unspecified flaw in versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires no special conditions beyond a valid low-privilege account and HTTP access, with resulting impacts across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full-impact triad make this a credible priority for any Oracle EBS deployment.
Unauthenticated HTTP access to Oracle Purchasing (a component of Oracle E-Business Suite versions 12.2.3-12.2.15) enables remote attackers to read critical or complete procurement data with no credentials, user interaction, or elevated attack complexity. Tagged as an authentication bypass by EUVD (EUVD-2026-61894) and disclosed through Oracle's August 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.5, reflecting a fully network-exposed, zero-prerequisite attack path. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Oracle Purchasing versions 12.2.5 through 12.2.15 within Oracle E-Business Suite expose an authorization bypass flaw in the Internal Operations component, allowing any authenticated low-privileged network user to gain complete read access to all purchasing data and perform unauthorized creation, deletion, or modification of critical records. Tagged as an Authentication Bypass by ENISA EUVD-2026-61762, the vulnerability is exploitable over HTTP with no user interaction and low attack complexity, making it a high-priority remediation target in Oracle EBS deployments. No public exploit code has been identified and the vulnerability is not currently listed in the CISA KEV catalog at time of analysis.
Oracle Purchasing within E-Business Suite versions 12.2.3 through 12.2.15 exposes a local privilege escalation in the Internal Operations component that yields full application takeover. A low-privileged attacker with OS-level logon to the infrastructure running Oracle Purchasing can exploit this flaw without any additional complexity or user interaction, achieving complete confidentiality, integrity, and availability compromise of the Purchasing module. No public exploit has been identified at time of analysis, but Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' materially elevating practical risk for organizations running EBS in shared or multi-tenant server environments.
Oracle Purchasing, a procurement module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity network-exploitable vulnerability in its Internal Operations component that enables full system takeover - complete loss of confidentiality, integrity, and availability. Oracle itself classifies this as 'easily exploitable' despite the high-privilege requirement (PR:H), meaning that once an attacker possesses elevated credentials, exploitation presents no meaningful technical barrier. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the full CIA impact and low attack complexity make this a priority patching target for any organization running internet-exposed or broadly network-accessible Oracle EBS deployments.
Oracle Purchasing (E-Business Suite component: Internal Operations), versions 12.2.3 through 12.2.15, exposes critical data to unauthorized read and write operations by low-privileged authenticated network attackers over HTTP. The vulnerability is tagged as an Authentication Bypass, suggesting that a user with minimal system privileges can circumvent authorization controls to access or manipulate purchasing data beyond their permitted scope - including complete confidentiality and integrity compromise of all Oracle Purchasing accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the low attack complexity and broad affected version range make this a meaningful priority for Oracle EBS deployments.
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Endeca). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Full takeover of Oracle Purchasing within Oracle E-Business Suite is achievable by any low-privileged, network-authenticated attacker exploiting this unspecified flaw in versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires no special conditions beyond a valid low-privilege account and HTTP access, with resulting impacts across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full-impact triad make this a credible priority for any Oracle EBS deployment.
Unauthenticated HTTP access to Oracle Purchasing (a component of Oracle E-Business Suite versions 12.2.3-12.2.15) enables remote attackers to read critical or complete procurement data with no credentials, user interaction, or elevated attack complexity. Tagged as an authentication bypass by EUVD (EUVD-2026-61894) and disclosed through Oracle's August 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.5, reflecting a fully network-exposed, zero-prerequisite attack path. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Oracle Purchasing versions 12.2.5 through 12.2.15 within Oracle E-Business Suite expose an authorization bypass flaw in the Internal Operations component, allowing any authenticated low-privileged network user to gain complete read access to all purchasing data and perform unauthorized creation, deletion, or modification of critical records. Tagged as an Authentication Bypass by ENISA EUVD-2026-61762, the vulnerability is exploitable over HTTP with no user interaction and low attack complexity, making it a high-priority remediation target in Oracle EBS deployments. No public exploit code has been identified and the vulnerability is not currently listed in the CISA KEV catalog at time of analysis.
Oracle Purchasing within E-Business Suite versions 12.2.3 through 12.2.15 exposes a local privilege escalation in the Internal Operations component that yields full application takeover. A low-privileged attacker with OS-level logon to the infrastructure running Oracle Purchasing can exploit this flaw without any additional complexity or user interaction, achieving complete confidentiality, integrity, and availability compromise of the Purchasing module. No public exploit has been identified at time of analysis, but Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' materially elevating practical risk for organizations running EBS in shared or multi-tenant server environments.
Oracle Purchasing, a procurement module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity network-exploitable vulnerability in its Internal Operations component that enables full system takeover - complete loss of confidentiality, integrity, and availability. Oracle itself classifies this as 'easily exploitable' despite the high-privilege requirement (PR:H), meaning that once an attacker possesses elevated credentials, exploitation presents no meaningful technical barrier. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the full CIA impact and low attack complexity make this a priority patching target for any organization running internet-exposed or broadly network-accessible Oracle EBS deployments.
Oracle Purchasing (E-Business Suite component: Internal Operations), versions 12.2.3 through 12.2.15, exposes critical data to unauthorized read and write operations by low-privileged authenticated network attackers over HTTP. The vulnerability is tagged as an Authentication Bypass, suggesting that a user with minimal system privileges can circumvent authorization controls to access or manipulate purchasing data beyond their permitted scope - including complete confidentiality and integrity compromise of all Oracle Purchasing accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the low attack complexity and broad affected version range make this a meaningful priority for Oracle EBS deployments.
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Endeca). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.