This vulnerability affects Oracle Project Intelligence, a component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized access and modification of critical data within the product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 other patches across multiple products. Oracle advises customers to remain on supported versions and apply patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data in Oracle Project Intelligence, as well as unauthorized access to all accessible data within the product. The confidentiality and integrity of data are severely impacted, but availability is not affected. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers using affected versions (12.2.3 through 12.2.15) should apply the official patches promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.