This vulnerability affects Oracle Order Management component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It requires a high privileged attacker who already has logon access to the infrastructure hosting Oracle Order Management. Exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Order Management. The vulnerability scope extends beyond Oracle Order Management, potentially affecting other Oracle products. The CVSS 3.1 vector is AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N, indicating local attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and high confidentiality and integrity impact with no availability impact. No known exploits in the wild have been reported. Oracle has published a Critical Security Patch Update (August 2026) that includes security fixes for this and other vulnerabilities.

An attacker with high privileges and logon access to the Oracle Order Management infrastructure can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data within Oracle Order Management. This can lead to significant data compromise and may also affect other Oracle products due to scope change. The confidentiality and integrity of data are highly impacted, but availability is not affected. No public exploits are known at this time.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Customers are strongly advised to apply these patches promptly to mitigate the risk. Staying on actively supported versions and applying Oracle's security patches without delay is recommended. No additional mitigation steps are specified beyond patching.