This vulnerability in Oracle Financials for Asia/Pacific (versions 12.2.3 to 12.2.15) allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or accessible data, and unauthorized read access to a subset of data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. Oracle's August 2026 Critical Security Patch Update addresses this and many other vulnerabilities, urging customers to apply patches promptly.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized capabilities to create, delete, or modify critical data within Oracle Financials for Asia/Pacific, as well as read some data without authorization. This compromises data confidentiality and integrity but does not affect system availability. The vulnerability is rated high severity with a CVSS score of 7.1.

Oracle has released security patches for this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to remediate the vulnerability. Staying on actively supported versions and promptly applying Oracle's security updates is the recommended mitigation. No alternative or temporary mitigations are specified in the advisory.