This vulnerability affects Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 to 12.2.15. An unauthenticated attacker with network access via HTTP can exploit this flaw, but successful exploitation requires user interaction from a third party. The vulnerability can lead to full compromise of Oracle Applications DBA, impacting confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, required user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published a Critical Security Patch Update in August 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply Oracle's security patches promptly.

Successful exploitation can result in complete takeover of Oracle Applications DBA, affecting confidentiality, integrity, and availability of the system. The attack requires network access and user interaction from a person other than the attacker, making exploitation difficult but impactful if successful.

Oracle has released security patches as part of its August 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches. No additional mitigation steps are specified beyond patching.