CVE-2026-87127
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Vulnerability in Oracle Purchasing within Oracle E-Business Suite (component: G-Invoicing) affecting versions 12.2.10-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the system. It can lead to unauthorized access to critical data, and the attack may impact additional products (scope change).
Risk Assessment
An attacker could gain access to critical data in Oracle Purchasing, potentially breaching information confidentiality. Scope change means effects may also impact other systems.
Recommendation
Update Oracle E-Business Suite to the latest patched version. Restrict network access to the system and monitor for unusual user activity.
Other vulnerabilities in Oracle Purchasing
See all- CVE-2026-87265High
Vulnerability in Oracle Purchasing (component: Other issue) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to create, delete or modify data and gain unauthorized access to critical information.
- CVE-2026-87168High
Vulnerability in Oracle Purchasing (component: G-Invoicing) versions 12.2.10-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in unauthorized creation, deletion, or modification of data and unauthorized access to data.
- CVE-2026-87167High
Vulnerability in Oracle Purchasing (component: G-Invoicing) versions 12.2.11-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in unauthorized creation, deletion, or modification of data and unauthorized access to data.
- CVE-2026-87166High
Vulnerability in Oracle Purchasing (component: Other issue) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in unauthorized creation, deletion, or modification of data and unauthorized access to data.
- CVE-2026-87163High
Vulnerability in Oracle Purchasing (component: Other issue) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in takeover of the Oracle Purchasing system.
- CVE-2026-70811High
Vulnerability in Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.5-12.2.15. A low-privileged attacker can compromise confidentiality and integrity via HTTP, gaining unauthorized access to critical data and the ability to create, delete, or modify it.
- CVE-2026-70798High
Vulnerability in Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. Easily exploitable by low privileged attacker with logon to the infrastructure, allowing takeover of Oracle Purchasing.
- CVE-2026-70797High
Vulnerability in Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. Easily exploitable by high privileged attacker with network access via HTTP, allowing takeover of Oracle Purchasing.
- CVE-2026-62491High
Vulnerability in Oracle Purchasing (part of Oracle E-Business Suite, component: Internal Operations) versions 12.2.3-12.2.15. A low-privileged attacker can gain unauthorized access to critical data or modify it via HTTP. CVSS score 8.1.
Original NVD description (English source)
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). Supported versions that are affected are 12.2.10-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. While the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS