This vulnerability affects Oracle Project Intelligence within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data or all accessible data, and unauthorized read access to a subset of data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update advisory.

The vulnerability enables unauthorized creation, deletion, or modification of critical or all accessible data in Oracle Project Intelligence, as well as unauthorized read access to some data. This can compromise data integrity and confidentiality within the affected product. There is no reported impact on availability. The vulnerability is exploitable by a low privileged attacker over the network without user interaction.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Project Intelligence versions 12.2.3 through 12.2.15 are strongly advised to apply the relevant patches promptly to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.