This vulnerability affects Oracle General Ledger component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, leading to unauthorized creation, deletion, or modification of critical or all accessible data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact.

Successful exploitation can result in unauthorized modification (high integrity impact) of critical Oracle General Ledger data, unauthorized partial reading of data (low confidentiality impact), and partial denial of service (low availability impact). This could compromise financial data integrity and availability within affected Oracle E-Business Suite environments.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected Oracle General Ledger versions 12.2.3 through 12.2.15. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are noted in the advisory.