Vulnerability in Oracle Purchasing Product of Oracle E-Business Suite
CVE-2026-70948

8.8HIGH

Key Information:

Vendor

Oracle
Status
Oracle Purchasing
Vendor
CVE Published:
18 August 2026

What is CVE-2026-70948?

A vulnerability exists in the Oracle Purchasing component of the Oracle E-Business Suite, impacting supported versions from 12.2.3 to 12.2.15. This flaw can be exploited by low privileged attackers who possess network access via HTTP, allowing them to compromise the Oracle Purchasing application. Successful exploitation may enable unauthorized takeover of the system, posing significant risks to confidentiality, integrity, and availability. It is crucial for organizations utilizing this product to implement the necessary security patches and follow guidance from the vendor.

Affected Version(s)

Oracle Purchasing 12.2.3 <= 12.2.15

References

https://www.oracle.com/security-alerts/cspuaug2026.html
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.