---
id: "CVE-2026-101846"
kind: "vulnerability"
aliases: ["CVE-2026-101846"]
title: "Oracle E-Business Suite Purchasing: low-privilege users can alter some purchasing data"
severity: "low"
cvss: 3.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "package", "purchasing"]
not_affected_if: ["version-outside-range"]
published_at: "2026-10-20T22:18:40+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T04:45:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101846", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite Purchasing: low-privilege users can alter some purchasing data

Oracle E-Business Suite's Purchasing module, versions 12.2.3 through 12.2.15, has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can make unauthorized updates, inserts or deletes to some purchasing data, but only if a second person interacts with the attack.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle E-Business Suite release and confirm whether Oracle Purchasing falls within `12.2.3` to `12.2.15`
- unknown for the exact patch level, since the sources do not list the fix or patch identifiers

## Fix

- Apply the Oracle Critical Patch Update that covers this CVE for Oracle E-Business Suite Purchasing (patch identifiers unknown from the sources)
- Move Oracle Purchasing to a release outside `12.2.3` to `12.2.15` once a fixed release is available

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101846

## From the sources

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 3.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_