This vulnerability affects Oracle Marketing component Audience in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by a low privileged attacker with network access via HTTP, enabling compromise of Oracle Marketing. Successful exploitation can result in unauthorized access to critical data or full access to all Oracle Marketing accessible data, as well as unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 score of 8.5 with network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and low integrity impact. Oracle’s September 2026 Critical Security Patch Update includes patches addressing this and many other vulnerabilities.

Exploitation of this vulnerability can lead to unauthorized access to sensitive and critical data within Oracle Marketing, including full access to all accessible data and the ability to modify data via update, insert, or delete operations. The scope of impact may extend beyond Oracle Marketing to additional products. The confidentiality impact is high, and integrity impact is low, with no impact on availability. This could lead to significant data breaches and unauthorized data manipulation within affected environments.

Oracle has released patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.