This vulnerability affects Oracle Applications Platform Engineering in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It involves the Valid Session component and permits an unauthenticated attacker with network access via Oracle Net to compromise the system. The CVSS 3.1 base score is 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is considered difficult to exploit. Oracle has addressed this issue in its August 2026 Critical Security Patch Update, which provides targeted security fixes for this and many other vulnerabilities.

Successful exploitation can lead to full takeover of Oracle Applications Platform Engineering, affecting confidentiality, integrity, and availability of the system. The vulnerability allows unauthenticated remote network access via Oracle Net, posing a significant risk if exploited.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly. Oracle recommends staying on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities. No additional vendor advisory states that no action is required or that the issue is already mitigated without patching.