This vulnerability affects Oracle Payments within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit but allows an unauthenticated attacker with network access over HTTPS to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Payments. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 fixes, recommending patch application.

If exploited, this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Payments, or unauthorized access to all data accessible by Oracle Payments. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits in the wild have been reported to date.

Oracle has included a fix for this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or temporary workarounds are specified in the advisory.