The vulnerability in Oracle Purchasing allows an attacker with low privileges and network access to craft HTTP requests that can create, modify, or delete data stored by the application. This results in a loss of integrity for the affected Purchasing data, although confidentiality and availability remain intact.

Oracle Purchasing for Oracle E-Business Suite is affected, specifically supported releases 12.2.3 through 12.2.15.

The CVSS Base score of 3.1 indicates a low severity level, with a high access‑complexity requirement and low needed privileges. EPSS score of 0.00176 indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting there are no known active exploit campaigns. Nonetheless, successful exploitation would grant the attacker unauthorized write or delete capabilities against Purchasing data by sending crafted HTTP requests to the application. The attack scenario therefore relies on network reachability and a low privileged account, but does not require additional system compromises.