This vulnerability affects the Personalization component of Oracle Applications Framework within Oracle E-Business Suite versions 12.2.9 to 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the framework, resulting in unauthorized access to critical data and the ability to modify some data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security fixes.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Applications Framework. Additionally, attackers can perform unauthorized update, insert, or delete operations on some data, compromising data integrity. The vulnerability does not impact availability. The CVSS score of 7.1 reflects a high severity due to the confidentiality and integrity impacts.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to affected versions (12.2.9 through 12.2.15) to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.