This vulnerability affects Oracle Applications Manager within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data within Oracle Applications Manager. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, impacting confidentiality with high severity. Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this and other vulnerabilities.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Applications Manager. There is no impact on integrity or availability according to the CVSS vector. The vulnerability is remotely exploitable without authentication, increasing the risk of data compromise.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying patches without delay. Patch status is confirmed as available via the official Oracle advisory.