This vulnerability affects Oracle Proposals component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise Oracle Proposals, resulting in unauthorized access to critical or all accessible data within Oracle Proposals. The vulnerability has a CVSS 3.1 score of 7.7, with attack vector network, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 other patches across multiple Oracle products. The vendor strongly recommends applying patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Proposals. The vulnerability affects confidentiality but does not impact integrity or availability. The scope change indicates potential impact on additional Oracle products beyond Oracle Proposals.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.