This vulnerability affects Oracle Scripting within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the product. The impact includes unauthorized creation, deletion, or modification of critical data, unauthorized access to critical or all accessible data, and the ability to cause a partial denial of service. The CVSS vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact.

The vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Scripting, unauthorized access to critical or all accessible data, and partial denial of service conditions. This compromises confidentiality, integrity, and availability of the Oracle Scripting component.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches without delay. The vendor advisory emphasizes staying on actively supported versions and promptly applying patches to mitigate exploitation risks.