This vulnerability affects Oracle General Ledger versions 12.2.3 through 12.2.15 and allows a high privileged attacker with network access via HTTP to compromise the system. The attack can lead to unauthorized access to critical data and unauthorized modification of some data within Oracle General Ledger. The vulnerability has a CVSS 3.1 score of 7.6, with network attack vector, low attack complexity, high privileges required, no user interaction, and scope change. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 other security patches across multiple Oracle products.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle General Ledger, as well as unauthorized update, insert, or delete operations on some of that data. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope of impact may extend beyond Oracle General Ledger to additional Oracle products.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends staying on actively-supported versions and applying security patches without delay. No additional mitigation steps are specified beyond patching.