This vulnerability affects Oracle Enterprise Asset Management component of Oracle E-Business Suite versions 12.2.6 through 12.2.15. It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to full takeover of Oracle Enterprise Asset Management, impacting confidentiality, integrity, and availability. The CVSS 3.1 score is 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes 245 security patches across various Oracle products. The vendor advisory strongly urges customers to apply these patches without delay to mitigate the risk. No explicit patch version for this vulnerability is provided in the advisory, so users must consult the official patch documentation.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Enterprise Asset Management, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to unauthorized access, data manipulation, and service disruption.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch status is not explicitly confirmed for a specific version in the advisory; users should consult the June 2026 Critical Security Patch Update documentation for detailed patch availability and installation instructions.