This vulnerability affects Oracle Report Manager component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access over HTTPS to compromise Oracle Report Manager, resulting in unauthorized access to critical or all accessible data and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update advisory.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Report Manager, compromising confidentiality. Additionally, attackers can cause a partial denial of service affecting availability. There is no reported impact on data integrity. The vulnerability is exploitable remotely by attackers with low privileges over HTTPS.

Oracle has released security patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. Oracle emphasizes remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.