This vulnerability affects Oracle Order Management versions 12.2.5 through 12.2.15 and is exploitable by an attacker with low privileges who can access the system over HTTP. Successful exploitation can lead to unauthorized access to sensitive data within Oracle Order Management and may impact additional Oracle products due to scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches across multiple Oracle products.

An attacker with network access and low privileges can exploit this vulnerability to gain unauthorized access to critical data or potentially all data accessible via Oracle Order Management. The vulnerability affects confidentiality but does not impact integrity or availability. Due to scope change, exploitation may also affect additional Oracle products beyond Order Management.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches promptly to remediate this issue. Oracle recommends remaining on actively supported versions and applying patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.