CVE-2026-91511 in Purchasing
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. While the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Purchasing accessible data as well as unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Internal Operations component of Oracle Purchasing, a critical module in the Oracle E-Business Suite ecosystem. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The nature of this defect is characterized by its complexity, requiring an attacker to possess specific conditions and potentially multiple steps to successfully exploit it. Despite being classified as difficult to exploit, the vulnerability presents a significant risk because it allows for unauthorized access and manipulation of data within the purchasing domain. This highlights the importance of maintaining up-to-date software versions even when exploitation difficulty is high, as automated tools or targeted attacks can still leverage such flaws if proper controls are not in place.
From an operational perspective, this vulnerability enables low-privileged attackers who have network access via HTTP to compromise the integrity and confidentiality of Oracle Purchasing data. The attack vector relies on network connectivity over standard web protocols, which means that any system exposed to internal or external networks with sufficient reachability is potentially at risk. Although the initial point of entry requires only low-level privileges, the consequences are severe due to a scope change phenomenon. While the technical flaw originates in Oracle Purchasing, successful exploitation can lead to impacts on additional products within the broader E-Business Suite environment. This lateral movement capability amplifies the threat landscape, as attackers may pivot from purchasing data access to compromising other interconnected business modules, thereby increasing the overall blast radius of a single vulnerability instance.
The impact assessment indicates high confidentiality and low integrity implications according to CVSS 3.1 standards, resulting in a base score of 7.1 which denotes a High severity level. Successful exploitation grants attackers unauthorized access to critical data stored within Oracle Purchasing. This includes sensitive financial records, supplier information, purchase orders, and contract details that are essential for business operations. Furthermore, the vulnerability allows for unauthorized updates, inserts, or deletes on some accessible data sets. This capability threatens the integrity of transactional records, potentially leading to fraudulent activities, inaccurate reporting, or operational disruptions if malicious actors alter procurement workflows or financial commitments without authorization.
In terms of industry standard classifications, this vulnerability aligns with CWE-200 Information Exposure and CWE-798 Use of Hard-coded Credentials depending on the specific mechanism used for privilege escalation or data access. The network-based exploitation via HTTP maps to MITRE ATT&CK techniques such as T1071 Application Layer Protocol: Web Protocols, where attackers use standard web traffic to blend in with legitimate activity and avoid detection by basic security monitoring tools. Additionally, the ability to modify data corresponds to T1565 Data Manipulation, reflecting the potential for unauthorized changes to stored information. Understanding these mappings helps organizations prioritize remediation efforts based on known adversary behaviors and common exploitation patterns observed in enterprise environments.
To mitigate this risk, immediate action should be taken to apply the latest security patches provided by Oracle for all affected versions within the 12.2.x series. Organizations must verify their current patch levels against the official Oracle Security Alerts documentation to ensure that the specific fix for this internal operations flaw is deployed. In addition to patching, implementing strict network segmentation can limit exposure by restricting HTTP access to only authorized management interfaces or application servers. Deploying Web Application Firewalls with rules tailored to detect anomalous behavior in purchasing-related endpoints may also provide an additional layer of defense against exploitation attempts. Regular audits of user privileges are essential to ensure that low-privileged accounts do not have unnecessary access to sensitive modules, thereby reducing the attack surface available to potential intruders who might leverage this vulnerability for further compromise.