Vulnerability in Oracle Purchasing Component of Oracle E-Business Suite
CVE-2026-87265

8.1HIGH

Key Information:

Vendor

Oracle
Status
Oracle Purchasing
Vendor
CVE Published:
15 September 2026

What is CVE-2026-87265?

A notable vulnerability exists within the Oracle Purchasing component of the Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. This issue can be exploited by low-privileged attackers with network access, particularly through HTTP. The exploitation leads to unauthorized actions, such as the ability to create, delete, or modify critical data within the Oracle Purchasing environment. This compromises the integrity and confidentiality of the accessible data, thereby posing a significant risk to organizations utilizing this software.

Affected Version(s)

Oracle Purchasing 12.2.3 <= 12.2.15

References

https://www.oracle.com/security-alerts/cspusep2026.html
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.