Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Oracle |
|
No data.
References
| Link | Providers |
|---|---|
| https://www.oracle.com/security-alerts/cspusep2026.html |
|
History
Mon, 21 Sep 2026 04:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Oracle Purchasing Access Control Flaw Enables Low-Privilege Data Modification and Full Data Access |
Mon, 21 Sep 2026 02:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Access Control Failure in Oracle Purchasing Allows Low-Privilege Data Manipulation and Unauthorized Access | |
| Weaknesses | CWE-285 |
Mon, 21 Sep 2026 00:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 | |
| Metrics |
ssvc
|
Sun, 20 Sep 2026 07:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Access Control Failure in Oracle Purchasing Allows Low-Privilege Data Manipulation and Unauthorized Access | |
| Weaknesses | CWE-285 |
Fri, 18 Sep 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Unauthorized Modification, Deletion, and Creation of Data via Access Control Failure in Oracle Purchasing | |
| Weaknesses | CWE-284 |
Wed, 16 Sep 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Unauthorized Modification, Deletion, and Creation of Data via Access Control Failure in Oracle Purchasing | |
| Weaknesses | CWE-284 |
Tue, 15 Sep 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Purchasing accessible data as well as unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). | |
| First Time appeared |
Oracle
Oracle purchasing |
|
| CPEs | cpe:2.3:a:oracle:purchasing:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Oracle
Oracle purchasing |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: oracle
Published: 2026-09-15T20:06:03.029Z
Updated: 2026-09-20T23:53:13.530Z
Reserved: 2026-09-08T21:49:12.400Z
Link: CVE-2026-87166
Vulnrichment
Updated: 2026-09-20T23:45:35.817Z
NVD
Status : Analyzed
Published: 2026-09-15T20:19:04.280
Modified: 2026-09-22T19:02:21.400
Link: CVE-2026-87166
Redhat
No data.