This vulnerability exists in Oracle Quality versions 12.2.3 and potentially other versions within 12.2.3-12.2.15 as noted in the advisory. It allows an attacker with low privileges and network access over HTTP to compromise Oracle Quality, potentially leading to complete takeover of the application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update addresses this vulnerability among 245 other security fixes. The vendor strongly urges applying the patch without delay to prevent exploitation.

If exploited, this vulnerability can result in full compromise of Oracle Quality, including unauthorized disclosure, modification, and disruption of data and services. The attacker requires only low privileges and network access via HTTP, making it easily exploitable. This can lead to significant operational and security impacts on organizations using the affected Oracle E-Business Suite component.

Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability. Customers are strongly advised to apply the security patches as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. Oracle emphasizes that these mitigations may affect application functionality and that patching is the recommended remediation.