This vulnerability affects the Oracle Application Object Library component of Oracle E-Business Suite in versions 12.2.3 to 12.2.15. It permits an unauthenticated attacker with network access over HTTP to compromise the application, resulting in unauthorized access to critical or all accessible data within the Oracle Application Object Library. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack can be performed remotely with low complexity, no privileges, and no user interaction, causing a high confidentiality impact but no integrity or availability impact. Oracle has published this vulnerability as part of its September 2026 Critical Security Patch Update (CSPU), which includes targeted security fixes. Oracle strongly recommends applying the relevant patches promptly to mitigate this vulnerability.

Successful exploitation allows an unauthenticated remote attacker to access sensitive or all data accessible through the Oracle Application Object Library, compromising confidentiality. There is no impact on integrity or availability. This could lead to unauthorized disclosure of critical business data managed by the Oracle E-Business Suite component.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using affected versions (12.2.3 through 12.2.15) should apply the official patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to prevent exploitation. No alternative mitigations or workarounds are specified by Oracle.