This vulnerability affects Oracle Internet Procurement Connector within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to gain unauthorized access that can result in creation, deletion, or modification of critical data accessible through the product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is identified as CWE-284 (Improper Access Control). Oracle has published this issue in its August 2026 Critical Security Patch Update advisory but has not explicitly provided a direct patch link for this specific vulnerability in the provided data.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle Internet Procurement Connector. This compromises confidentiality and integrity of the data but does not affect availability. The attacker requires only low privileges and network access via HTTP, making the vulnerability easily exploitable.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update, which includes fixes for this vulnerability among 943 other security patches. Customers should remain on actively supported versions and apply security patches without delay. Patch status is confirmed as available via the Oracle Critical Security Patch Update advisory. No additional mitigation steps are specified beyond applying the official patches.