This vulnerability affects Oracle Financials Common Modules within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the modules, resulting in unauthorized access to critical data or complete access to all data accessible through Oracle Financials Common Modules. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. The vulnerability may also affect additional Oracle products due to scope change. Oracle has published a Critical Security Patch Update (August 2026) addressing this and many other vulnerabilities, strongly recommending patch application.

Successful exploitation can lead to unauthorized access to critical data within Oracle Financials Common Modules and potentially other Oracle products due to scope change. The confidentiality of sensitive information is severely impacted, but integrity and availability are not affected. This could compromise sensitive financial data and related business processes.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update, which includes fixes for this vulnerability. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.