Executive brief
A vulnerability exists in Oracle Purchasing, a component of the Oracle E-Business Suite used by organizations to manage procurement and supply chain operations. A low-privileged user could exploit this flaw to gain full control over the purchasing system. Such an attack could lead to the unauthorized disclosure of sensitive financial data, disruption of procurement workflows, and loss of data integrity.
Technical details
This vulnerability affects the Internal Operations component of Oracle Purchasing within the Oracle E-Business Suite. It is classified as a high-severity issue that allows a low-privileged attacker to achieve a complete takeover of the affected product. The attack vector is network-based via HTTP, though the exploit is characterized as having high complexity, suggesting specific conditions or configurations must be met. Successful exploitation results in a total loss of confidentiality, integrity, and availability (C/I/A) for the Oracle Purchasing module. Users are advised to refer to the Oracle Critical Patch Update for July 2026 for remediation guidance.
Affected products
- Oracle Purchasing 12.2.11-12.2.15
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory