This vulnerability affects Oracle Project Planning and Control component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within the product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts. The vulnerability is tracked as CWE-306 (Missing Authentication for Critical Function). Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability among 943 patches across multiple products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data in Oracle Project Planning and Control, as well as unauthorized access to all accessible data within the product. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability is exploitable remotely over the network with low attack complexity and requires low privileges, increasing risk.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patch.