This vulnerability exists in the Oracle Marketing product of Oracle E-Business Suite (component: Audience) affecting versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access via HTTP to exploit the flaw without user interaction, resulting in complete compromise of Oracle Marketing. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to full takeover of Oracle Marketing, compromising confidentiality, integrity, and availability of the affected system. This could allow attackers to access sensitive data, modify or disrupt operations within Oracle Marketing. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required, increasing the risk of attack.

Oracle has released fixes for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Marketing versions 12.2.3 through 12.2.15 immediately. Oracle strongly advises remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.