This vulnerability affects the Command Line - RapidClone component of Oracle Applications Manager in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits an unauthenticated attacker with network access over HTTP to compromise the application, resulting in unauthorized access to critical or all data accessible through Oracle Applications Manager. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the attack requires no privileges or user interaction and can be performed remotely with low complexity, causing high confidentiality impact but no integrity or availability impact. Oracle has released patches as part of its September 2026 Critical Security Patch Update to remediate this issue.

Successful exploitation can lead to unauthorized access to critical or all data accessible via Oracle Applications Manager, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of compromise if unpatched.

Oracle has released a security patch for this vulnerability in the September 2026 Critical Security Patch Update. Users should apply the official patch promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.