CVE-2026-101559 in Purchasing
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: PO View Document). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the PO View Document component of Oracle Purchasing, a core module in Oracle E-Business Suite designed to manage procurement processes and purchase order documentation. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The nature of this defect allows for unauthorized access to sensitive organizational data without requiring complex exploitation techniques or user interaction, representing a significant risk to the confidentiality integrity of enterprise resource planning systems that rely on Oracle E-Business Suite for critical supply chain operations.
From a technical perspective, the vulnerability is characterized by an insufficient authorization check within the PO View Document functionality. This architectural flaw enables low-privileged attackers who possess valid network access via HTTP to bypass intended security controls and retrieve restricted information. The attack vector is classified as remote with low complexity, meaning that no special conditions or user interaction are required for exploitation beyond having a basic authenticated account on the system. The absence of necessary privilege verification allows malicious actors to query internal database structures directly through web requests, effectively treating protected data fields as publicly accessible resources within the application context.
The operational impact of this vulnerability is primarily centered around severe confidentiality breaches. Successful exploitation results in unauthorized access to critical business data and potentially complete access to all Oracle Purchasing accessible information. This includes sensitive details such as vendor contracts, pricing agreements, purchase order histories, and internal procurement strategies that are not intended for general user visibility. The disclosure of such proprietary information can lead to competitive disadvantage, financial fraud through manipulation of supply chain relationships, or serve as a stepping stone for further lateral movement within the corporate network if additional vulnerabilities exist in connected systems.
In terms of industry standard classifications, this vulnerability aligns with CWE-284 Improper Access Control and specifically CWE-639 Authorization Bypass Through User-Controlled Key if the exploit relies on manipulating document identifiers to access records belonging to other users or departments. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, as it requires an attacker with low-level privileges to leverage legitimate credentials for unauthorized data exfiltration rather than exploiting a code execution flaw. The CVSS 3.1 base score of 6.5 reflects the medium severity driven by high confidentiality impact despite limited availability and integrity impacts, indicating that while system uptime is not directly threatened, the value of stolen intellectual property and confidential business records is substantial.
Mitigation strategies must prioritize immediate patching to the latest available version of Oracle E-Business Suite which includes fixes for this specific PO View Document flaw. Organizations should verify their current software versions against the supported range and apply security patches provided by Oracle as part of their regular maintenance cycle. In environments where immediate patching is not feasible due to operational constraints, implementing strict network segmentation can help isolate the affected systems from untrusted networks. Additionally, deploying Web Application Firewalls with rulesets tuned for detecting unauthorized data access patterns related to purchase order documents may provide a layer of defense against exploitation attempts while permanent remediation efforts are underway. Regular audits of user privileges and enforcement of least-privilege principles will also reduce the attack surface by ensuring that only authorized personnel have access to sensitive procurement modules.