This vulnerability in Oracle Loans (Oracle E-Business Suite component Internal Operations) affects versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data and unauthorized modification capabilities (update, insert, delete) on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No known exploits in the wild have been reported. Oracle has published a Critical Security Patch Update advisory covering this and many other vulnerabilities but no direct patch link for this specific CVE was provided in the input data.

Successful exploitation allows unauthorized access to critical or all Oracle Loans data accessible to the attacker and unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of Oracle Loans data but does not impact availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Oracle has released a Critical Security Patch Update (August 2026) that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches promptly to affected Oracle E-Business Suite versions 12.2.3 through 12.2.15. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed as official-fix via the Oracle advisory. Organizations should ensure they remain on actively supported versions and apply Oracle security patches without delay.