{"id":"CVE-2026-101557","published":"2026-10-20T22:18:05.640","lastModified":"2026-10-24T04:18:08.153","description":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A vulnerability in Oracle Purchasing (part of Oracle E-Business Suite) allows a low-privileged attacker with network access via HTTP to achieve full compromise (takeover) of the component due to insufficient access controls or input validation.","exploitability":"Easily exploitable by a low-privileged attacker with network access via HTTP; no user interaction required.","blast_radius":"Successful exploitation leads to full compromise (CIA impact) of Oracle Purchasing, potentially enabling data theft, unauthorized modifications, and service disruption across the affected E-Business Suite module.","remediation":"Upgrade Oracle E-Business Suite to version 12.2.15 with the latest Critical Patch Update (CPU) or Security Patch Update (SPU) released after January 2026 that includes fix for CVE-2026-101557; if no fixed version is explicitly named, apply Oracle's recommended patch per My Oracle Support note referencing this CVE.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web-app","privilege-escalation","oracle-ebusiness","http"],"model":"garnet-coder","analyzedAt":"2026-10-26T09:05:12.494Z"}}