This vulnerability exists in the Oracle Applications Manager component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access over HTTPS to compromise the Oracle Applications Manager, potentially resulting in complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability. Oracle emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation can lead to full compromise of Oracle Applications Manager, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to take over the application, potentially leading to unauthorized access and control over Oracle E-Business Suite environments.

Oracle has released patches for this vulnerability as part of its September 2026 Critical Security Patch Update. Customers should apply these security patches promptly to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and applying all relevant security updates without delay. No alternative mitigations or workarounds are specified in the advisory.