Description
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Purchasing accessible data as well as unauthorized read access to a subset of Oracle Purchasing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.1 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized data modification and read in Oracle Purchasing
Action: Patch Issue
AI Analysis

Impact

The vulnerability exists in the Approvals component of Oracle Purchasing and allows an unauthenticated attacker who can reach the application over HTTP to trigger actions that, with the cooperation of a user other than the attacker, bypass authentication controls and perform unauthorized update, insert, delete, or read operations on Oracle Purchasing data. This reflects an improper access control weakness (CWE-284).

Affected Systems

Oracle Corporation’s Oracle Purchasing product, version 12.2.3 through 12.2.15, is affected. The flaw is specific to the Approvals component, and because the vulnerability can change scope, additional Oracle E‑Business Suite components may also be impacted if the unauthorized changes spread. Network exposure over HTTP is required.

Risk and Exploitability

The CVSS 3.1 base score of 6.1 indicates a medium level of severity with moderate confidentiality and integrity impacts. The vulnerability requires a separate human to interact with the system, which limits the likelihood of exploitation, but the attack vector is network‑based and the EPSS score is not available. It is not currently listed in the CISA KEV catalog. Until a patch is released, the risk can be managed through network restriction and strict access control measures.

Generated by OpenCVE AI on October 21, 2026 at 00:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a vendor patch as soon as one becomes available.
  • Restrict network access to Oracle Purchasing to trusted hosts or authenticated VPN endpoints.
  • Review and enforce the minimum required permissions for the Approvals component to limit data modification and read capabilities.

Generated by OpenCVE AI on October 21, 2026 at 00:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via HTTP in Oracle Purchasing Approvals
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Purchasing accessible data as well as unauthorized read access to a subset of Oracle Purchasing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle purchasing
CPEs cpe:2.3:a:oracle:purchasing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle purchasing
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Purchasing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:33.212Z

Reserved: 2026-09-28T15:40:09.491Z

Link: CVE-2026-101558

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:05.823

Modified: 2026-10-20T22:18:05.823

Link: CVE-2026-101558

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T00:15:14Z

Weaknesses