This vulnerability affects Oracle Warehouse Management component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized modification of critical data and partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. Oracle's August 2026 Critical Security Patch Update advisory addresses this vulnerability among others, urging customers to apply patches without delay.

Successful exploitation allows unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Warehouse Management, compromising data integrity. It also enables an attacker to cause a partial denial of service, impacting availability. There is no confidentiality impact reported. The vulnerability is exploitable remotely over the network with low complexity and requires low privileges.

Oracle has released patches for this vulnerability as part of its August 2026 Critical Security Patch Update. Customers should apply the relevant patches promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.