This vulnerability affects Oracle XML Gateway component of Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the gateway, resulting in unauthorized access to critical or all accessible data and the ability to cause partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle XML Gateway and partial denial of service conditions. This compromises confidentiality and availability of the affected system. There is no reported impact on integrity. No known exploits are reported in the wild at this time.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions (12.2.3 through 12.2.15). Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.