This vulnerability affects Oracle Applications Manager within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with network access over HTTP and low privileges, enabling compromise and potential takeover of Oracle Applications Manager. The vulnerability also has a scope change, meaning it can significantly impact other Oracle products beyond Applications Manager. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to complete compromise of Oracle Applications Manager, affecting confidentiality, integrity, and availability of the system. Due to scope change, additional Oracle products may also be impacted. This can result in unauthorized access, data breaches, and disruption of services managed by Oracle Applications Manager.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability among others. Customers should apply the June 2026 Critical Security Patch Update immediately to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and removing unnecessary privileges from users. However, these workarounds may impact application functionality. Oracle strongly recommends patching as the primary mitigation.