This vulnerability affects Oracle Mobile Application Server component of Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits an attacker with low privileges and network access via HTTP to compromise the server, resulting in unauthorized access to sensitive or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Oracle's August 2026 Critical Security Patch Update addresses this vulnerability among 943 patches. The vendor strongly recommends applying patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Mobile Application Server. The confidentiality of data is severely impacted, but there is no reported impact on data integrity or system availability. The vulnerability requires network access and low privileges but no user interaction.

Oracle has released a Critical Security Patch Update in August 2026 that includes a fix for this vulnerability. Customers should apply the official Oracle patches promptly to remediate this issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated by the vendor advisory.