This vulnerability affects Oracle Applications Manager within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is a difficult to exploit flaw that requires a high privileged attacker with network access via HTTP. Successful exploitation can lead to complete compromise and takeover of Oracle Applications Manager. The vulnerability has a CVSS 3.1 score of 8.0 with high impact on confidentiality, integrity, and availability, and the scope of impact extends to other Oracle products. Oracle has published a Critical Security Patch Update including fixes for this vulnerability and advises customers to apply patches without delay to mitigate risk.

Successful exploitation allows an attacker with high privileges and network access to take over Oracle Applications Manager, compromising confidentiality, integrity, and availability of the component. Due to scope change, other Oracle products may also be significantly impacted. The vulnerability poses a high risk to affected environments if unpatched.

Oracle has released a Critical Security Patch Update that includes a fix for this vulnerability. Customers should apply the relevant patches from the September 2026 Critical Security Patch Update promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No additional mitigation steps are indicated beyond patching.