This vulnerability affects Oracle General Ledger component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It enables a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data, unauthorized update, insert, or delete operations on some data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. Oracle’s August 2026 Critical Security Patch Update includes fixes for this vulnerability as part of a large set of security patches.

Successful exploitation can lead to unauthorized access to sensitive and critical data within Oracle General Ledger, unauthorized modification of some data, and partial denial of service conditions. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released patches for this vulnerability in its August 2026 Critical Security Patch Update. Customers should apply these official patches without delay to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches. No additional vendor advisory states that no action is required or that the issue is already mitigated without patching.