Description
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Purchasing, part of Oracle E‑Business Suite, contains a flaw that allows an attacker with low privileges and network access to create, modify, or delete critical data. The vulnerability undermines the confidentiality and integrity of all Oracle Purchasing data, enabling attackers to manipulate business information or gain unauthorized access to sensitive records.

Affected Systems

Affected are Oracle Purchasing products within Oracle E‑Business Suite, specifically versions 12.2.5 through 12.2.15. These versions expose the vulnerability to attackers who can reach the system over HTTP.

Risk and Exploitability

The vulnerability scores 8.1 on CVSS 3.1 with a network vector (AV:N) and low attack complexity (AC:L), requiring only low privileges (PR:L). The EPSS score is 0.00392, and the vulnerability is not listed in CISA KEV. Attackers with network access can exploit the flaw without user interaction, potentially leading to unauthorized data manipulation.

Generated by OpenCVE AI on August 21, 2026 at 07:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle E‑Business Suite patch updates for versions 12.2.5–12.2.15 to address the vulnerability.
  • Restrict network access to the Oracle Purchasing application by limiting HTTP traffic to trusted IP ranges or placing it behind an intranet firewall.
  • Enforce least‑privilege access for all Oracle Purchasing users and disable unused accounts, ensuring that only authorized personnel can operate with database privileges.

Generated by OpenCVE AI on August 21, 2026 at 07:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
Title Improper Access Control in Oracle Purchasing Enables Low‑Privilege Data Manipulation
Weaknesses CWE-269
CWE-284

Fri, 21 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Low Privilege Access Allows Unauthorized Critical Data Manipulation in Oracle Purchasing
Weaknesses CWE-284
CWE-732

Wed, 19 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Title Low Privilege Access Allows Unauthorized Critical Data Manipulation in Oracle Purchasing
Weaknesses CWE-284
CWE-732

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle purchasing
CPEs cpe:2.3:a:oracle:purchasing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle purchasing
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Purchasing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T15:22:18.596Z

Reserved: 2026-08-04T22:06:34.598Z

Link: CVE-2026-70811

cve-icon Vulnrichment

Updated: 2026-08-24T15:12:49.207Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:35.657

Modified: 2026-08-27T18:29:21.843

Link: CVE-2026-70811

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T07:30:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control