This vulnerability affects Oracle Risk Management component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Risk Management. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is identified as CWE-284 (Improper Access Control). Oracle has addressed this issue in its August 2026 Critical Security Patch Update, which includes 943 security patches across various Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Risk Management, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying patches without delay. Patch availability details and installation instructions are provided in the Oracle advisory. No alternative mitigations or temporary fixes are indicated.