This vulnerability affects Oracle Quality within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable over the network via HTTP by an attacker with low privileges, though exploitation is considered difficult. Successful exploitation can result in complete compromise of Oracle Quality, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability. The vendor strongly recommends applying the patch without delay to prevent exploitation.

If exploited, this vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Quality, affecting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, data modification, and service disruption within Oracle Quality.

Oracle has released a security patch for this vulnerability as part of its September 2026 Critical Security Patch Update. Customers should apply the official patch promptly to remediate the issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the vendor advisory.