This vulnerability in Oracle Quality (component: Internal Operations) of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data or complete access to all Oracle Quality accessible data, as well as unauthorized update, insert, or delete access to some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Affected versions are 12.2.3 through 12.2.15. Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical and all accessible data within Oracle Quality. The attacker can also modify data by performing unauthorized update, insert, or delete operations. This compromises confidentiality and integrity of the data but does not affect availability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Users of Oracle Quality versions 12.2.3 through 12.2.15 should apply the official patches provided by Oracle without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation.