This vulnerability affects Oracle Application Object Library within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It involves the Attachments / File Upload component and can be exploited remotely by an attacker with low privileges over HTTP. Successful exploitation can lead to complete compromise of the Oracle Application Object Library. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise the Oracle Application Object Library, impacting confidentiality, integrity, and availability of the affected component. This could lead to unauthorized access and control over the Oracle Application Object Library within Oracle E-Business Suite environments running affected versions.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the security patches promptly to affected versions (12.2.3 through 12.2.15) to mitigate the risk. Oracle recommends remaining on actively-supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the vendor advisory.