This vulnerability affects Oracle General Ledger component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit and requires a high-privileged attacker with existing logon access to the infrastructure hosting Oracle General Ledger. Successful exploitation can compromise Oracle General Ledger by allowing unauthorized creation, deletion, or modification of critical data. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond General Ledger. The CVSS 3.1 vector indicates local attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts with no availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability and recommends applying patches without delay.

An attacker with high privileges and logon access to the Oracle General Ledger infrastructure can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data within Oracle General Ledger. This can lead to significant data compromise and may affect additional Oracle products due to scope change. The confidentiality and integrity of data are severely impacted, but availability is not affected.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers should apply the relevant patches from this update promptly to remediate the issue. Oracle strongly recommends staying on actively-supported versions and applying security patches without delay. Patch availability and installation instructions are detailed in Oracle's official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.