This vulnerability affects Oracle Partner Management component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is exploitable remotely over HTTP by unauthenticated attackers but requires human interaction from a third party. The vulnerability can lead to unauthorized access and modification of critical data within Oracle Partner Management and may impact additional Oracle products due to scope change. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, required user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes targeted high-priority fixes.

Successful exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data within Oracle Partner Management. The vulnerability also has a scope change effect, potentially impacting additional Oracle products beyond Oracle Partner Management. The confidentiality impact is high, integrity impact is low, and availability is not affected.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users of Oracle Partner Management versions 12.2.3 through 12.2.15 should apply the relevant security patches without delay to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates. No alternative mitigations or workarounds are specified in the vendor advisory.