This vulnerability affects Oracle Site Hub, a component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the system, enabling unauthorized creation, deletion, or modification of critical data or all accessible data, and unauthorized read access to some data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) reflects network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches across multiple products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data within Oracle Site Hub, as well as unauthorized read access to a subset of accessible data. This compromises data integrity and confidentiality but does not affect availability. The vulnerability is exploitable remotely over the network with low complexity and requires only low privileges, increasing risk.

Oracle has released security patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.