This vulnerability affects Oracle Applications DBA component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data and the ability to cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized access to critical or all Oracle Applications DBA accessible data, compromising confidentiality. Additionally, attackers can cause a partial denial of service affecting availability. There is no reported impact on data integrity. The vulnerability is rated high severity with a CVSS score of 7.1.

Oracle has released security patches as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to affected versions 12.2.3 through 12.2.15 of Oracle Applications DBA. Staying on actively supported versions and timely application of patches is critical to mitigate this vulnerability. No alternative mitigations or temporary fixes are indicated in the vendor advisory.