This vulnerability affects Oracle Internet Procurement Connector within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is difficult to exploit but allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the Oracle Internet Procurement Connector. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact without availability impact. Oracle's advisory for the August 2026 Critical Security Patch Update references this vulnerability among 943 patches released.

An attacker exploiting this vulnerability can gain unauthorized access to critical data within Oracle Internet Procurement Connector, including the ability to create, delete, or modify such data. This compromises the confidentiality and integrity of the affected system's data. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Oracle has released patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed as available via Oracle's official advisory.