This vulnerability affects Oracle Web Applications Desktop Integrator component of Oracle E-Business Suite, specifically in the file download functionality. It is exploitable remotely over the network via HTTPS by an attacker with low privileges and no user interaction required. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible through the integrator. The vulnerability also has scope change implications, potentially impacting additional Oracle products. Oracle has addressed this issue in its September 2026 Critical Security Patch Update, which includes targeted security fixes for affected versions 12.2.3 through 12.2.15.

The vulnerability allows unauthorized access to critical data or complete access to all data accessible via Oracle Web Applications Desktop Integrator. This compromises confidentiality but does not impact integrity or availability. The scope change indicates that other Oracle products may also be affected indirectly. The CVSS score of 7.7 reflects a high severity due to network attack vector, low attack complexity, and high confidentiality impact.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these official patches without delay to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or temporary fixes are specified by Oracle.