Executive brief
Oracle Sourcing is a procurement module within Oracle E-Business Suite that manages supplier relationships and purchase requisitions. A network-accessible vulnerability allows low-privileged users to gain complete control over the Sourcing system, potentially exposing sensitive procurement data and allowing unauthorized transactions. Exploitation is difficult but possible with network access, posing a risk to organizations relying on this system for supply chain operations.
Technical details
A privilege escalation vulnerability exists in the Oracle Sourcing component (Internal Operations) of E-Business Suite affecting versions 12.2.3–12.2.15. The vulnerability is remotely exploitable via HTTP by an authenticated low-privileged attacker and is difficult to exploit (AC:H). Successful exploitation results in complete system compromise with high impact to confidentiality, integrity, and availability. No patch status is currently documented; Oracle's security advisory page is unavailable in the provided reference content.
Affected products
- Oracle E-Business Suite Sourcing 12.2.3 to 12.2.15
Timeline
- 2026-09-15: disclosed
- 2026-09-15: advisory