This vulnerability affects Oracle Learning Management within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity but not availability. Oracle’s advisory confirms this vulnerability is addressed in their August 2026 Critical Security Patch Update.

Successful exploitation allows an unauthenticated remote attacker to read and modify some data accessible through Oracle Learning Management, potentially compromising confidentiality and integrity of that data. There is no impact on system availability. The vulnerability is considered medium severity based on the CVSS score of 6.5.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches promptly to remediate the issue. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.