This vulnerability affects the Oracle Applications Framework component of Oracle E-Business Suite, specifically the Search Bean (including Advanced) in versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized access to critical data and the ability to create, delete, or modify such data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability as part of a broader set of security patches.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Applications Framework, as well as unauthorized access to all data accessible through the framework. This compromises confidentiality and integrity of the affected systems. There is no reported impact on availability. The vulnerability is exploitable remotely with low privileges and no user interaction required.

Oracle has released a security patch addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply this patch promptly to remediate the issue. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.