This vulnerability in Oracle Sales (Oracle E-Business Suite) versions 12.2.3 to 12.2.15 permits a low-privileged attacker with network access over HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Sales. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

An attacker with low privileges and network access can exploit this vulnerability to gain unauthorized access to critical data within Oracle Sales, including the ability to create, delete, or modify data. This compromises the confidentiality and integrity of the data but does not affect availability. The impact is significant given the critical nature of the data involved.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected Oracle Sales versions (12.2.3 through 12.2.15). Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are detailed in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.