Description
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 3.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).
Published: 2026-10-20
Score: 3.5 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Modification
Action: Apply Patch
AI Analysis

Impact

This vulnerability allows a low‑privileged attacker with network access via HTTP to modify Oracle Purchasing data, including unauthorized updates, inserts, or deletes. The flaw is an information‑exposure weakness (CWE‑200) that compromises data integrity. The impact is limited to integrity, with the CVSS 3.1 base score 3.5 reflecting low severity but still significant for affected business processes.

Affected Systems

Oracle Purchasing, a component of Oracle E‑Business Suite, for supported versions 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS base score of 3.5 indicates low severity, and the EPSS score of less than 1% confirms an extremely low exploitation probability. The vulnerability is not listed in CISA KEV. The likely attack vector is HTTP network access, requiring a low‑privileged account and human interaction from a non‑attacker. No public exploits have been reported, but successful attacks could lead to data tampering and potential business disruption.

Generated by OpenCVE AI on October 28, 2026 at 01:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Purchasing security patch from the Oracle support portal.
  • Configure network controls or firewall rules to limit HTTP access to trusted network segments or privileged users.
  • Train and remind end users to avoid providing login credentials to unknown individuals and verify the authenticity of any requests that prompt for their credentials.

Generated by OpenCVE AI on October 28, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via Information Exposure in Oracle Purchasing

Tue, 27 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege Unauthorized Data Modification via HTTP in Oracle Purchasing
Weaknesses CWE-284
CWE-285

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege Unauthorized Data Modification via HTTP in Oracle Purchasing
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 3.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).
First Time appeared Oracle
Oracle purchasing
CPEs cpe:2.3:a:oracle:purchasing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle purchasing
References
Metrics cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Oracle Purchasing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T11:46:08.520Z

Reserved: 2026-09-28T15:40:09.511Z

Link: CVE-2026-101846

cve-icon Vulnrichment

Updated: 2026-10-27T11:45:53.859Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:40.620

Modified: 2026-10-27T12:16:55.440

Link: CVE-2026-101846

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:30:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor