This vulnerability in Oracle Marketing (component: Audience) of Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation results in unauthorized access to critical or all Oracle Marketing accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update (CSPU), which provides targeted security fixes. Customers are strongly advised to apply the relevant patches promptly.

Exploitation of this vulnerability can lead to unauthorized disclosure of critical data or complete access to all data accessible through Oracle Marketing. There is no impact on data integrity or availability. The vulnerability is exploitable remotely without authentication, increasing the risk of compromise if the system is exposed to untrusted networks.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the official patches for Oracle Marketing versions 12.2.3 through 12.2.15 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to mitigate exploitation risks.