This vulnerability affects Oracle Complex Maintenance, Repair and Overhaul in Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized access to critical data or full access to all accessible data within the product, as well as partial denial of service. The vulnerability has a CVSS 3.1 score of 7.1 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L, indicating network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes 943 security patches across multiple products. Customers are advised to apply patches without delay to mitigate this risk.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Complex Maintenance, Repair and Overhaul. Additionally, it can cause a partial denial of service condition. The vulnerability affects confidentiality and availability but not integrity. The attack requires network access via HTTP and low privileges but is difficult to exploit. There are no known exploits in the wild at this time.

Oracle has released patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply these patches promptly to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patches.