This vulnerability exists in the Oracle Applications Manager component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access over HTTP to compromise the Oracle Applications Manager, potentially resulting in complete takeover of the application. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update advisory, which includes targeted patches for this and many other vulnerabilities.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Applications Manager, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over the Oracle Applications Manager component within Oracle E-Business Suite, potentially affecting business-critical operations managed through this application.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions (12.2.3 through 12.2.15) to remediate the vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.