This vulnerability in Oracle Public Sector Financials (International) allows an attacker with low privileges and network access via HTTP to compromise the product by gaining unauthorized capabilities to update, insert, or delete certain accessible data, read a subset of data without authorization, and cause partial denial of service. The affected versions are 12.2.3 through 12.2.15 inclusive. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized modification (update, insert, delete) of some accessible data, unauthorized reading of a subset of data, and partial denial of service affecting availability of Oracle Public Sector Financials (International). The impact affects confidentiality, integrity, and availability but at a low level each, resulting in an overall medium severity.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to affected versions 12.2.3 through 12.2.15. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch availability details are provided in the Oracle advisory. No additional mitigation steps are specified beyond applying the official patches.