This vulnerability affects Oracle Subledger Accounting within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the system, potentially resulting in full takeover of the Oracle Subledger Accounting component. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with attack vector network, attack complexity high, and no user interaction required. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which contains 245 security patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to complete compromise of Oracle Subledger Accounting, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected component, potentially disrupting financial operations and exposing sensitive accounting data.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the issue. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory linked in the report.