This vulnerability affects the Oracle Application Object Library component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTPS without authentication but is considered difficult to exploit due to the required attack conditions. If exploited, it can result in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by the Oracle Application Object Library. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact.

An attacker exploiting this vulnerability could gain unauthorized access to critical data within the Oracle Application Object Library, including the ability to create, delete, or modify such data. This could compromise the integrity and confidentiality of sensitive information managed by the application. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions (12.2.3 through 12.2.15) to mitigate this risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.