This vulnerability affects Oracle Spares Management versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTPS to compromise the system. Successful exploitation can result in complete takeover of Oracle Spares Management, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 8.8. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products. Oracle strongly advises customers to apply these patches without delay to mitigate the risk. Workarounds include blocking network protocols required by the attack and removing unnecessary privileges, but these may disrupt application functionality.

The vulnerability allows an attacker with low privileges and network access via HTTPS to fully compromise Oracle Spares Management, resulting in high confidentiality, integrity, and availability impacts. This could lead to unauthorized data access, modification, and service disruption within the affected Oracle E-Business Suite component.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users, though these measures may affect application functionality. Patch status is confirmed by the vendor advisory. No indication that the vulnerability is already mitigated or requires no action.