CVE-2026-70947

Analyzed Analyzed - Analysis Complete

Unauthenticated Data Access in Oracle Purchasing

Publication date: 2026-08-18

Last updated on: 2026-08-27

Assigner: Oracle

Description

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-27

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-70947

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	purchasing	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Purchasing within Oracle E-Business Suite. It allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or full access to all Oracle Purchasing accessible data.

Detection Guidance

This vulnerability affects Oracle Purchasing in Oracle E-Business Suite versions 12.2.3 to 12.2.15. Detection requires checking for unauthorized access attempts via HTTP to the Oracle Purchasing component. Review server logs for unusual HTTP requests targeting the Oracle Purchasing module. Ensure all Oracle E-Business Suite instances are updated to the latest patch levels.

Impact Analysis

An attacker could gain unauthorized access to sensitive purchasing data, potentially leading to data breaches, financial loss, or operational disruptions. The impact includes exposure of confidential information and potential misuse of purchasing system functions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access. Organizations may face legal penalties, reputational damage, and loss of customer trust if sensitive data is compromised.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for versions 12.2.3 to 12.2.15. Restrict network access to HTTP ports used by Oracle Purchasing. Monitor for unauthorized access attempts to critical data.

Hi! I’m here to help you understand CVE-2026-70947. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70