This vulnerability affects Oracle Payables in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Payables. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact.

An attacker with low privileges and network access can exploit this vulnerability to gain unauthorized creation, deletion, or modification rights on critical data within Oracle Payables or gain complete access to all data accessible by Oracle Payables. This compromises the confidentiality and integrity of sensitive financial data managed by Oracle Payables.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.