---
id: "CVE-2026-101845"
kind: "vulnerability"
aliases: ["CVE-2026-101845"]
title: "Oracle E-Business Suite Purchasing: low-privilege user can alter some data"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["erp", "on-prem", "oracle-ebs", "purchasing", "vendor"]
not_affected_if: ["auth-required", "oracle-ebs-not-12.2.3-12.2.15", "purchasing-module-not-used"]
published_at: "2026-10-20T22:18:40+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T04:47:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101845", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite Purchasing: low-privilege user can alter some data

Oracle E-Business Suite Purchasing versions 12.2.3 through 12.2.15 contain a flaw in the Internal Operations component. An authenticated low-privilege user with HTTP network access can make unauthorized updates, inserts or deletes to some Purchasing data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Oracle E-Business Suite release in use is within `12.2.3` to `12.2.15` for the Purchasing module
- Check the applied patch level against Oracle's Critical Patch Update advisory for this CVE (unknown from the sources)

## Fix

- Apply the Oracle Critical Patch Update for E-Business Suite Purchasing that addresses CVE-2026-101845 (patch id unknown from the sources)
- Restrict HTTP access to Purchasing to required users until patched

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101845

## From the sources

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_