CVE-2026-101846

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Request Forgery in Oracle Purchasing

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: Oracle

Description

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 3.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101846

EUVD

EUVD-2026-106244

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Purchasing	12.2.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Purchasing within Oracle E-Business Suite affecting versions 12.2.3 to 12.2.15. It allows a low-privileged attacker with network access via HTTP to potentially modify data in Oracle Purchasing if a user is tricked into interacting with a malicious request. The impact is limited to unauthorized data changes (insert, update, delete) without affecting confidentiality or availability.

Detection Guidance

This vulnerability requires manual detection as no specific commands are provided in the CVE details. Focus on monitoring Oracle Purchasing components for unauthorized data changes or unusual HTTP traffic patterns. Check Oracle E-Business Suite logs for suspicious activity in versions 12.2.3 to 12.2.15.

Impact Analysis

If exploited, this vulnerability could allow an attacker to alter purchasing data such as orders or transactions without proper authorization. This might lead to incorrect financial records, procurement errors, or supply chain disruptions. However, exploitation requires user interaction and is limited in scope to specific data within Oracle Purchasing.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to purchasing data, which may include sensitive financial or procurement information. Such unauthorized changes could violate integrity requirements in GDPR (data accuracy) or HIPAA (record integrity). Organizations must ensure proper controls to prevent and detect such modifications to maintain compliance.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for the Purchasing component (versions 12.2.3-12.2.15). Restrict network access to HTTP interfaces and limit user privileges to reduce attack surface. Monitor for unauthorized data modifications in Oracle Purchasing.

Hi! I’m here to help you understand CVE-2026-101846. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...