This vulnerability in Oracle One-to-One Fulfillment (component: Documents) allows an attacker with low privileges and physical network access to the hardware communication segment to compromise the system. Successful exploitation can lead to full takeover of the Oracle One-to-One Fulfillment application. The affected versions are from 12.2.3 up to and including 12.2.15. The CVSS 3.1 vector indicates the attack requires adjacent network access, low attack complexity, low privileges, no user interaction, and results in high confidentiality, integrity, and availability impacts. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

The vulnerability allows an attacker with low privileges and physical access to the communication segment attached to the hardware running Oracle One-to-One Fulfillment to fully compromise the application. This can lead to complete takeover, impacting confidentiality, integrity, and availability of the system. Given the high CVSS score of 8.0, the impact is significant if exploited.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle One-to-One Fulfillment versions 12.2.3 through 12.2.15 immediately. Oracle strongly advises remaining on actively supported versions and applying security patches promptly to mitigate exploitation risk. Patch status is confirmed as available via the Oracle advisory.