This vulnerability affects Oracle Cash Management component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It requires an attacker to have high privileges and logon access to the infrastructure hosting Oracle Cash Management. Exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Cash Management. The CVSS vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle has published a Critical Security Patch Update advisory for August 2026 covering this and many other vulnerabilities, strongly recommending patch application.

An attacker with high privileges and logon access to the Oracle Cash Management infrastructure can compromise the system to gain unauthorized creation, deletion, or modification capabilities over critical data, or full access to all data accessible by Oracle Cash Management. This impacts confidentiality and integrity of sensitive financial data managed by the product. There is no reported impact on availability. No known exploits in the wild have been reported.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches promptly to affected Oracle E-Business Suite versions 12.2.3 through 12.2.15. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability details are provided in the Oracle advisory. No alternative mitigations or workarounds are specified.