Description
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification, creation, or deletion via a low-privileged HTTP attack
Action: Immediate Patch
AI Analysis

Impact

A low-privileged attacker with network access via HTTP can exploit a flaw in Oracle Purchasing to create, delete, or modify critical data, and gain full read or write access to all Oracle Purchasing data. The vulnerability delivers high confidentiality and integrity impact as reflected in the CVSS 3.1 Base Score of 8.1.

Affected Systems

The Oracle Purchasing component of Oracle E‑Business Suite is affected, specifically versions 12.2.3 through 12.2.15.

Risk and Exploitability

The flaw can be exploited easily: an attacker only needs network access and a low-privilege account, with no user interaction required. The EPSS score of < 1% indicates a very low chance of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N confirms that the attack is carried out over the network and damages confidentiality and integrity.

Generated by OpenCVE AI on September 20, 2026 at 06:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Purchasing patch or upgrade to a version newer than 12.2.15
  • Restrict network access to Oracle Purchasing using firewall rules or network segmentation
  • Enforce strict authentication and authorization controls to limit what low‑privileged accounts can do, ensuring proper access control

Generated by OpenCVE AI on September 20, 2026 at 06:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Title Low‑privileged HTTP Attack Enables Unauthorized Data Modification in Oracle Purchasing

Sun, 20 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via HTTP in Oracle Purchasing

Fri, 18 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 16 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification via HTTP in Oracle Purchasing

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle purchasing
CPEs cpe:2.3:a:oracle:purchasing:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle purchasing
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Purchasing
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-18T14:47:05.846Z

Reserved: 2026-09-08T21:49:12.407Z

Link: CVE-2026-87265

cve-icon Vulnrichment

Updated: 2026-09-18T13:47:52.033Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:19:15.153

Modified: 2026-09-22T18:59:48.917

Link: CVE-2026-87265

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T06:15:07Z

Weaknesses