This vulnerability in Oracle Configure to Order (component: Supply to Order Workbench) allows a low-privileged attacker with network access via HTTP to perform unauthorized actions on critical data, including creation, deletion, or modification. The vulnerability affects Oracle E-Business Suite versions 12.2.3 through 12.2.15. It has a CVSS 3.1 score of 8.1 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact. The June 2026 Oracle Critical Security Patch Update addresses this vulnerability among 245 others. Oracle advises customers to apply the patch immediately to prevent exploitation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Configure to Order, compromising confidentiality and integrity of all accessible data. This could allow an attacker to manipulate or access sensitive business data without authorization. Availability is not impacted according to the CVSS vector. No known exploits in the wild have been reported to date.

Oracle has released a Critical Security Patch Update in June 2026 that includes a fix for this vulnerability. Customers are strongly advised to apply this patch promptly to mitigate the risk. Until the patch is applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges from users. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.