This vulnerability affects the Oracle One-to-One Fulfillment component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is a difficult to exploit flaw that permits an unauthenticated attacker with network access over HTTP to compromise the system, potentially resulting in full takeover of the Oracle One-to-One Fulfillment product. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches across multiple products.

Successful exploitation can lead to complete compromise of Oracle One-to-One Fulfillment, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the product, potentially leading to unauthorized access and control over the affected environment.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches promptly to mitigate this risk. Oracle recommends remaining on actively-supported versions and applying patches without delay. Patch status is confirmed as available via the vendor advisory.