Description
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Vulnerability in Oracle Purchasing version 12.2.3–12.2.15 allows low‑privilege attackers with network access through the HTTP interface to fully compromise the application. The flaw is easily exploitable and bypasses normal authentication controls, enabling attackers to take over Oracle Purchasing with complete confidentiality, integrity, and availability loss.

Affected Systems

Oracle Purchasing versions 12.2.3 through 12.2.15 are affected. All installations of these releases that expose the HTTP interface to external networks are at risk.

Risk and Exploitability

The CVSS v3.1 base score of 8.8 reflects high severity. The EPSS score is less than 1 %, suggesting a low current exploitation probability, but the lack of mitigations and the web‑based attack surface imply that the vulnerability remains a valuable target. The issue is not listed in CISA KEV, yet attacks can be launched from any host that can reach Oracle Purchasing over HTTP, making weaponization straightforward.

Generated by OpenCVE AI on August 21, 2026 at 03:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Purchasing patch that fixes the discovered vulnerability.
  • Restrict network access to the Oracle Purchasing HTTP interface to trusted hosts or internal IP ranges.
  • Enforce strict role‑based access controls and audit user privileges for all interactions with the application.

Generated by OpenCVE AI on August 21, 2026 at 03:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Title Remote HTTP Vulnerability Enables Full Application Compromise in Oracle Purchasing

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote HTTP Attack Enables Full Takeover of Oracle Purchasing
Weaknesses CWE-284

Wed, 19 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote HTTP Attack Enables Full Takeover of Oracle Purchasing
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle purchasing
CPEs cpe:2.3:a:oracle:purchasing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle purchasing
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Purchasing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-20T17:19:52.633Z

Reserved: 2026-08-04T22:06:34.607Z

Link: CVE-2026-70948

cve-icon Vulnrichment

Updated: 2026-08-20T16:09:58.663Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:53.050

Modified: 2026-08-27T18:29:39.430

Link: CVE-2026-70948

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T03:15:03Z

Weaknesses