This vulnerability affects Oracle Receivables versions 12.2.3 to 12.2.15 and involves a difficult-to-exploit flaw that allows an unauthenticated attacker with network access via SOAP to compromise the Oracle Receivables component. Successful exploitation can lead to full takeover of Oracle Receivables, impacting confidentiality, integrity, and availability. The CVSS 3.1 score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across multiple products. Oracle strongly advises customers to apply these patches without delay. Workarounds include blocking network protocols required for the attack and removing unnecessary privileges, though these may affect application functionality.

Successful exploitation of this vulnerability can result in complete takeover of the Oracle Receivables component, affecting confidentiality, integrity, and availability of the system. The attacker does not require authentication but must have network access via SOAP. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.1.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Until patches are applied, risk can be reduced by blocking network protocols required by the attack and by removing unnecessary privileges from users who do not require them, though these measures may impact application functionality. Oracle recommends staying on actively supported versions and applying security patches without delay.