This vulnerability affects Oracle Email Center component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. Successful exploitation can result in unauthorized access to sensitive data and partial unauthorized data modification within Oracle Email Center. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability.

Exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some Oracle Email Center accessible data. The vulnerability affects confidentiality and integrity but not availability. The scope change indicates potential impact on additional Oracle products beyond Email Center. The CVSS score of 8.2 reflects a high severity level.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.