This vulnerability exists in the Oracle Sales product of Oracle E-Business Suite (component: Internal Operations) and affects versions 12.2.3 to 12.2.15 inclusive. It allows an attacker with low privileges and network access via HTTP to compromise Oracle Sales. The scope of impact extends beyond Oracle Sales, potentially affecting additional products. Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible through Oracle Sales. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no integrity or availability impact. Oracle has published a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability.

An attacker with low privileges and network access can exploit this vulnerability to gain unauthorized access to critical data within Oracle Sales, potentially escalating to full access of all Oracle Sales accessible data. The vulnerability's scope change means it may also impact additional Oracle products beyond Oracle Sales. The confidentiality impact is high, but there is no direct impact on data integrity or availability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.