This vulnerability in Oracle E-Business Suite's Applications DBA (ADPatch) affects versions 12.2.3 to 12.2.15. It permits an unauthenticated attacker who has logon access to the infrastructure to compromise the Applications DBA component. Exploitation requires user interaction from someone other than the attacker. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that the attack vector is local, with low attack complexity, no privileges required, but user interaction is needed. Successful exploitation can lead to full takeover of Applications DBA, impacting confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability. The vendor strongly recommends applying these patches promptly to mitigate risk.

The vulnerability allows an unauthenticated attacker with local logon access to the infrastructure to compromise the Applications DBA component, potentially resulting in full takeover. This impacts confidentiality, integrity, and availability of the affected system. Exploitation requires human interaction from a user other than the attacker, which may limit automated exploitation but does not eliminate risk. The high CVSS score (7.8) reflects significant potential impact if exploited.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the available patches without delay to remediate this issue. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates. No indication from the vendor advisory suggests that no action is required or that the vulnerability is already mitigated without patching.