This vulnerability in Oracle Sales (Oracle E-Business Suite) versions 12.2.3 to 12.2.15 allows an attacker with low privileges and network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Sales, as well as unauthorized modification capabilities including update, insert, or delete on some data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Exploitation of this vulnerability can result in unauthorized access to sensitive and critical data within Oracle Sales and unauthorized modification of some data. This compromises confidentiality and integrity of the affected system's data, potentially leading to data breaches or unauthorized data manipulation. There is no impact on system availability reported.

Oracle has released security patches addressing this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches without delay to remediate this issue. Oracle recommends remaining on actively supported versions and promptly applying security updates to prevent exploitation. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.