Description
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.10-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality and Integrity Compromise
Action: Patch
AI Analysis

Impact

The vulnerability allows a low‑privileged attacker with network access over HTTP to perform unauthorized creation, deletion or modification operations, and to read or obtain all data accessible to Oracle Purchasing. This results in a loss of confidentiality and integrity of critical purchasing information.

Affected Systems

Oracle Purchasing, a component of Oracle E‑Business Suite (G‑Invoicing), is affected. Versions 12.2.10 through 12.2.15 support the vulnerability. The issue originates from Oracle Corporation.

Risk and Exploitability

With a CVSS 3.1 base score of 8.1, the flaw is considered high severity. The exploit is network‑based, requiring only low privileges and no user interaction, making it readily exploitable. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, but the high score and ease of exploitation signal a significant risk to affected installations.

Generated by OpenCVE AI on September 21, 2026 at 03:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Purchasing patch or upgrade to a non‑affected release.
  • Restrict network exposure of the Oracle Purchasing service, for firewall and limiting HTTP access to trusted IP ranges.
  • Monitor logs for attempts to create, delete, or modify invoices and alert on suspicious activity, establishing a baseline for normal operation.

Generated by OpenCVE AI on September 21, 2026 at 03:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Access and Modification Vulnerability in Oracle Purchasing

Mon, 21 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Unauthorized Data Manipulation in Oracle Purchasing via HTTP
Weaknesses CWE-200
CWE-285

Mon, 21 Sep 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege Unauthorized Data Manipulation in Oracle Purchasing via HTTP
Weaknesses CWE-200
CWE-285

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Low‑Privileged Network Attack Compromises Oracle Purchasing Data
Weaknesses CWE-284

Wed, 16 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Title Low‑Privileged Network Attack Compromises Oracle Purchasing Data
Weaknesses CWE-284

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.10-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle purchasing
CPEs cpe:2.3:a:oracle:purchasing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle purchasing
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Purchasing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-20T23:53:13.238Z

Reserved: 2026-09-08T21:49:12.400Z

Link: CVE-2026-87168

cve-icon Vulnrichment

Updated: 2026-09-20T23:45:28.931Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:19:04.503

Modified: 2026-09-22T19:02:05.093

Link: CVE-2026-87168

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T04:00:13Z

Weaknesses