This vulnerability affects Oracle XML Gateway component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the Oracle XML Gateway, potentially gaining unauthorized access to all accessible data and causing a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized access to critical or all Oracle XML Gateway accessible data, compromising confidentiality. Additionally, it can cause a partial denial of service affecting availability of the Oracle XML Gateway. There is no reported impact on data integrity. The vulnerability is exploitable remotely over the network with low complexity and low privileges.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle XML Gateway versions 12.2.3 through 12.2.15 should apply the relevant patches promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.