This vulnerability affects Oracle Application Object Library in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits an unauthenticated attacker with network access over HTTP to compromise the component, potentially resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible via the Oracle Application Object Library. The CVSS 3.1 base score is 7.4, reflecting high confidentiality and integrity impacts with no availability impact. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security patches for this and other vulnerabilities across multiple Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible through the Oracle Application Object Library. This compromises confidentiality and integrity of the affected data. The vulnerability does not impact availability. It requires network access via HTTP but no privileges or user interaction, though it is considered difficult to exploit.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the relevant patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.