This vulnerability affects Oracle Common Applications component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the application, contingent on user interaction from a third party. The CVSS 3.1 base score is 7.3, reflecting high confidentiality and integrity impacts but no availability impact. Exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Common Applications. The vulnerability requires user interaction but no elevated privileges beyond low privilege network access. The vendor advisory indicates this vulnerability is addressed in the September 2026 Critical Security Patch Update, which includes targeted security fixes for affected Oracle products.

The vulnerability allows unauthorized actors to create, delete, or modify critical data or gain complete access to all data accessible by Oracle Common Applications. This compromises confidentiality and integrity of sensitive data within the affected Oracle E-Business Suite versions. There is no reported impact on availability. Exploitation requires user interaction from a person other than the attacker, and the attacker must have low privileged network access via HTTP.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. The vendor advisory emphasizes the importance of remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.