CVE-2026-62491: Oracle Purchasing Auth Bypass Vulnerability

CVE-2026-62491 Overview

CVE-2026-62491 is a high-severity vulnerability in the Oracle Purchasing product of Oracle E-Business Suite, specifically within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the vulnerability without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle Purchasing accessible data. Oracle disclosed the issue in an out-of-cycle security alert.

Critical Impact
Authenticated attackers can read, modify, or delete critical procurement data across all Oracle Purchasing records reachable through the affected instance.

Affected Products

Oracle E-Business Suite — Oracle Purchasing 12.2.3
Oracle E-Business Suite — Oracle Purchasing 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Purchasing 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-62491 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-62491

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Purchasing, part of Oracle E-Business Suite. An attacker holding a valid low-privileged account can send crafted HTTP requests to the exposed application and gain access far beyond the intent of their role. The impact spans both confidentiality and integrity: the attacker can read all data accessible to the Oracle Purchasing subsystem, and can also create, alter, or destroy records. Because Purchasing manages procurement workflows, purchase orders, supplier records, and requisitions, exploitation can distort financial data and business processes. Availability is not directly affected, but integrity damage in a procurement system often produces downstream operational impact.

Root Cause

Oracle has not published detailed root-cause information beyond the security alert. The CVSS vector indicates a network-reachable flaw that requires only low privileges and no user interaction, which is consistent with insufficient authorization enforcement on server-side endpoints in the Internal Operations component. Refer to the Oracle Security Alert for vendor guidance.

Attack Vector

Exploitation occurs over the network through HTTP against an authenticated Oracle E-Business Suite session. The attacker needs a low-privileged application account, no user interaction is required, and the attack complexity is low. Once authenticated, the attacker issues requests to the vulnerable Internal Operations functionality to read or manipulate Purchasing data outside their normal authorization scope.

No public proof-of-concept code is currently available. The EPSS probability is 0.392% as of 2026-08-20, indicating low observed exploitation likelihood at this time.

Detection Methods for CVE-2026-62491

Indicators of Compromise

Unexpected HTTP requests to Oracle Purchasing Internal Operations endpoints from accounts with limited procurement roles.
Unauthorized creation, modification, or deletion of purchase orders, requisitions, or supplier records outside normal business workflows.
Anomalous access patterns from low-privileged Oracle E-Business Suite user accounts querying broad procurement datasets.

Detection Strategies

Review Oracle E-Business Suite audit trails (FND_LOG_MESSAGES, sign-on audit, and Purchasing module audit tables) for privilege-inconsistent activity.
Correlate application-tier HTTP access logs with backend Purchasing data changes to identify requests that bypass normal role scope.
Baseline typical Purchasing activity per user role and alert on deviations such as bulk record enumeration or off-hours modifications.

Monitoring Recommendations

Enable and forward Oracle E-Business Suite application and database audit logs to a centralized SIEM or data lake for long-term retention and correlation.
Monitor for spikes in POST and PUT traffic to Internal Operations URLs and cross-reference against the initiating account's assigned responsibilities.
Alert on service-account or dormant-account activity against Purchasing endpoints, since these are common pivots for authenticated abuse.

How to Mitigate CVE-2026-62491

Immediate Actions Required

Apply the patches referenced in the Oracle Critical Patch Update / Security Alert covering Oracle E-Business Suite 12.2.3 through 12.2.15.
Inventory all Oracle E-Business Suite instances and confirm patch level for the Purchasing module.
Restrict network exposure of Oracle E-Business Suite to trusted networks and enforce VPN or zero-trust access for administrative and business users.
Review and reduce assigned responsibilities for low-privileged accounts to enforce least privilege in Purchasing.

Patch Information

Oracle addressed CVE-2026-62491 in the August 2026 Oracle Security Alert. Administrators should download and apply the fix from Oracle Security Alert cspuaug2026 through My Oracle Support, following the standard Oracle E-Business Suite patching procedure that includes adop phased patching and post-patch validation.

Workarounds

No official workaround replaces the patch; apply Oracle's fix as soon as maintenance windows allow.
Temporarily restrict access to the Purchasing Internal Operations functions via responsibility and menu exclusions until patching completes.
Place the Oracle E-Business Suite application tier behind a web application firewall and block direct internet exposure of Purchasing URLs.

bash

# Example: verify current EBS patch level for Purchasing (PO) module
sqlplus apps/<password> <<EOF
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN (SELECT bug_number FROM ad_bugs)
 ORDER BY last_update_date DESC
 FETCH FIRST 20 ROWS ONLY;
EOF

# Apply the Oracle Security Alert patch using adop
# (run as the applmgr OS user after downloading the patch from My Oracle Support)
adop phase=prepare
adop phase=apply patches=<PATCH_NUMBER_FROM_ORACLE_ALERT> workers=8
adop phase=finalize
adop phase=cutover
adop phase=cleanup