This vulnerability affects the Oracle Customer Interaction History component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data or complete access to all data accessible by the product. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, and no impact on integrity or availability. Oracle's September 2026 Critical Security Patch Update includes a fix for this vulnerability as part of a large set of security patches.

Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Customer Interaction History. The vulnerability's scope change means it may also impact additional Oracle products. The CVSS score of 7.7 reflects a high confidentiality impact but no integrity or availability impact. There are no known exploits in the wild at this time.

Oracle has released a security patch for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply this patch promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.