This vulnerability exists in the Third Party Data Integration component of Oracle Trading Community within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable remotely without authentication over HTTP, allowing attackers to compromise the system and access sensitive data. The vulnerability's scope may extend beyond Oracle Trading Community to impact additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, scope change, and high confidentiality impact. Oracle has published a Critical Security Patch Update including fixes for this vulnerability.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle Trading Community, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability is exploitable remotely without authentication, increasing risk.

Oracle has released a Critical Security Patch Update that includes a fix for this vulnerability. Customers should apply the August 2026 Critical Security Patch Update promptly to remediate this issue. Oracle strongly recommends staying on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.