{"id":"CVE-2026-101845","kind":"vulnerability","aliases":["CVE-2026-101845"],"related":[],"title":"Oracle E-Business Suite Purchasing: low-privilege user can alter some data","description":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).","summary":"Oracle E-Business Suite Purchasing versions 12.2.3 through 12.2.15 contain a flaw in the Internal Operations component. An authenticated low-privilege user with HTTP network access can make unauthorized updates, inserts or deletes to some Purchasing data.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","on-prem","oracle-ebs","purchasing","vendor"],"not_affected_if":["auth-required","oracle-ebs-not-12.2.3-12.2.15","purchasing-module-not-used"],"how_to_check":"- Confirm the Oracle E-Business Suite release in use is within `12.2.3` to `12.2.15` for the Purchasing module\n- Check the applied patch level against Oracle's Critical Patch Update advisory for this CVE (unknown from the sources)","fix":"- Apply the Oracle Critical Patch Update for E-Business Suite Purchasing that addresses CVE-2026-101845 (patch id unknown from the sources)\n- Restrict HTTP access to Purchasing to required users until patched","status":"open","published_at":"2026-10-20T22:18:40+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T04:47:39+00:00","updated_at":"2026-10-25T04:47:39+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:47:39Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update for E-Business Suite Purchasing that addresses CVE-2026-101845 (patch id unknown from the sources)\n- Restrict HTTP access to Purchasing to required users until patched","reach":"network","title":"Oracle E-Business Suite Purchasing: low-privilege user can alter some data","impact":"low","summary":"Oracle E-Business Suite Purchasing versions 12.2.3 through 12.2.15 contain a flaw in the Internal Operations component. An authenticated low-privilege user with HTTP network access can make unauthorized updates, inserts or deletes to some Purchasing data.","category":"vendor","nicknames":[],"who_cares":["oracle-ebs","purchasing","erp","on-prem"],"confidence":0.6,"needs_auth":"yes","worst_case":"Unauthorized changes to some Purchasing records","analyst_note":"","how_to_check":"- Confirm the Oracle E-Business Suite release in use is within `12.2.3` to `12.2.15` for the Purchasing module\n- Check the applied patch level against Oracle's Critical Patch Update advisory for this CVE (unknown from the sources)","needs_analyst":false,"not_affected_if":["oracle-ebs-not-12.2.3-12.2.15","purchasing-module-not-used","auth-required"],"who_is_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Purchasing module exposed to users over HTTP. The attacker needs a low-privilege account, and the exploit is difficult, so systems with no Purchasing users or without network exposure to those users carry less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000656,"input_tokens":3457,"output_tokens":621,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-101845':17A,20A '-2026':16A,19A '/av':141C '12.2.15':39B,91C '12.2.3':37B,90C '3.1':131C,134C,140C 'access':57B,102C,122C,128C 'affect':88C 'allow':96C 'alter':12A 'attack':99C,110C 'authent':49B 'base':132C 'busi':4A,33B,79C 'compon':47B,81C 'compromis':106C 'contain':40B 'cve':15A,18A 'cvss':130C,137C,139C 'data':14A,68B,129C 'delet':64B,121C 'difficult':92C 'e':3A,32B,78C 'e-busi':2A,31B,77C 'eb':27B 'erp':21B 'exploit':94C 'flaw':42B 'h/pr':143C 'http':55B,104C 'impact':136C 'insert':62B,119C 'integr':135C 'intern':45B,82C 'l/a':148C 'l/ui':144C 'low':8A,51B,97C 'low-privileg':7A,50B 'make':59B 'n':149C 'n/ac':142C 'n/i':147C 'n/s':145C 'network':56B,101C 'on-prem':22B 'oper':46B,83C 'oracl':1A,26B,30B,72C,76C,107C,126C 'oracle-eb':25B 'prem':24B 'privileg':9A,52B,98C 'product':74C 'purchas':6A,28B,35B,67B,73C,108C,127C 'result':115C 'score':133C 'success':109C 'suit':5A,34B,80C 'support':84C 'u/c':146C 'unauthor':60B,117C 'updat':61B,118C 'user':10A,53B 'vector':138C 'vendor':29B 'version':36B,85C 'via':103C 'vulner':69C,95C,113C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Purchasing module exposed to users over HTTP. The attacker needs a low-privilege account, and the exploit is difficult, so systems with no Purchasing users or without network exposure to those users carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101845","severity":null,"published_at":"2026-10-20T22:18:40+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}