This vulnerability affects Oracle Payments in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit and requires a high privileged attacker with network access over HTTP. The vulnerability allows unauthorized creation, deletion, or modification of critical data, with a scope change potentially affecting other Oracle products. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 patches and strongly urges customers to apply patches promptly to mitigate risk.

Exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Payments, as well as unauthorized access to all Oracle Payments accessible data. The vulnerability's scope change means it may significantly impact additional Oracle products beyond Oracle Payments. The CVSS score of 7.7 indicates a high impact on confidentiality and integrity, but no impact on availability. No known exploits in the wild have been reported yet.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.