This vulnerability in Oracle One-to-One Fulfillment enables an attacker with low privileges and network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data and partial denial of service conditions. The affected versions are 12.2.3 through 12.2.15. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous patches across multiple products.

An attacker with low privileges and network access can exploit this vulnerability to gain unauthorized access to sensitive data within Oracle One-to-One Fulfillment and cause partial denial of service. This compromises confidentiality and availability of the system. There is no reported impact on integrity. No known exploits in the wild have been reported at this time.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions 12.2.3 through 12.2.15 of Oracle One-to-One Fulfillment. Oracle recommends remaining on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities. Patch status is confirmed by the vendor advisory.