This vulnerability affects Oracle Common Applications Calendar within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the application. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service conditions. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. Oracle has included this fix in their September 2026 Critical Security Patch Update, which contains targeted security patches for this and many other vulnerabilities.

The vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Common Applications Calendar. It also allows unauthorized access to all data accessible by the application and can cause a partial denial of service. These impacts affect confidentiality, integrity, and availability of the affected system.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.