This vulnerability affects the Oracle Applications Framework component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can result in complete compromise of the Oracle Applications Framework. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to take over the Oracle Applications Framework. This results in a high impact on confidentiality, integrity, and availability of the affected system, potentially allowing unauthorized access, data compromise, and disruption of services.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches from this update promptly to remediate the vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory indicating that a fix is available in the September 2026 Critical Security Patch Update.