This vulnerability affects Oracle One-to-One Fulfillment component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle One-to-One Fulfillment. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle One-to-One Fulfillment. It can also lead to unauthorized access to critical or all accessible data within the product. The confidentiality and integrity of data are severely impacted, but availability is not affected. This could compromise the integrity and confidentiality of business-critical information managed by Oracle One-to-One Fulfillment.

Oracle has released patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers using affected versions (12.2.3 through 12.2.15) should apply the relevant patches promptly to remediate this issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.