This vulnerability affects Oracle Customer Interaction History, a component of Oracle E-Business Suite (Outcome-Result). Versions 12.2.3 through 12.2.15 are impacted. The flaw allows an attacker with low privileges and network access over HTTP to compromise the system, potentially leading to complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products.

Successful exploitation can lead to full compromise of Oracle Customer Interaction History, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over sensitive customer interaction data.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Oracle emphasizes remaining on actively supported versions and applying security patches without delay to prevent exploitation. No indication was given that no action is required or that the vulnerability is already mitigated without patching.