This vulnerability affects Oracle Common Applications Calendar component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized creation, deletion, or modification of critical or accessible data, and unauthorized read access to a subset of data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Common Applications Calendar, as well as unauthorized read access to some data. This compromises data integrity and confidentiality but does not affect availability. The vulnerability is remotely exploitable over HTTP by a low privileged attacker without user interaction.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the vendor advisory.