This vulnerability affects Oracle Scripting in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP by unauthenticated attackers, allowing unauthorized access to critical or all Oracle Scripting accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. Oracle's August 2026 Critical Security Patch Update advisory includes patches addressing this vulnerability among 943 others. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation results in unauthorized access to critical data or complete access to all data accessible by Oracle Scripting. The vulnerability does not impact integrity or availability but poses a high confidentiality risk. No known exploits in the wild have been reported at this time.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update. Users should apply the relevant patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.