This vulnerability exists in the Audience component of Oracle Marketing within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with low privileges and network access via HTTP, enabling unauthorized access to critical or all data accessible through Oracle Marketing. The vulnerability has a CVSS 3.1 score of 7.7, with network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches across multiple products.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible via Oracle Marketing. The vulnerability affects confidentiality but does not impact integrity or availability. The scope change indicates that other Oracle products may be indirectly impacted by attacks exploiting this vulnerability.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond patching.