This vulnerability affects Oracle General Ledger versions 12.2.3 to 12.2.15 and is classified under CWE-284 (Improper Access Control). It requires network access via HTTP and low privileges but has a high attack complexity. The CVSS 3.1 base score is 7.1, reflecting high confidentiality and integrity impacts and a low availability impact. The vulnerability allows unauthorized manipulation and access to critical data and can cause partial denial of service. Oracle has published a Critical Security Patch Update advisory for August 2026 which includes patches addressing this and many other vulnerabilities. Oracle strongly recommends applying these patches promptly to mitigate the risk.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification rights over critical Oracle General Ledger data. They can also gain unauthorized access to all data accessible by Oracle General Ledger and cause a partial denial of service. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Customers are strongly advised to apply these patches without delay. Remaining on actively supported versions and promptly applying Oracle's security updates is critical to mitigating this vulnerability. No alternative mitigations or workarounds are specified in the advisory.