This vulnerability exists in the Authorization component of Oracle Public Sector Financials (International) within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with low privileges and network access via HTTP, enabling compromise of the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 others. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Public Sector Financials (International), resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to unauthorized data access, modification, and service disruption.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges from users. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.