This vulnerability affects Oracle Subledger Accounting component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in takeover. The CVSS 3.1 base score is 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function), CWE-269 (Improper Privilege Management), and CWE-284 (Improper Access Control). Oracle has addressed this vulnerability as part of its June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products including Oracle E-Business Suite. The vendor advisory does not specify a particular patch version but strongly urges customers to apply the Critical Security Patch Update promptly. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may disrupt application functionality.

Successful exploitation can lead to full compromise and takeover of Oracle Subledger Accounting, affecting confidentiality, integrity, and availability of the system. The vulnerability requires network access via HTTP and low privileges but is difficult to exploit. There are no known exploits in the wild at this time.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes fixes for this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for the attack and removing unnecessary privileges from users, though these measures may impact application functionality. Customers should remain on actively supported versions and apply security patches without delay. Patch status is not explicitly confirmed for a specific version; check the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.