This vulnerability affects Oracle XML Gateway component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by a low privileged attacker with network access via HTTP. Successful exploitation results in unauthorized access to critical or all accessible data within Oracle XML Gateway and can cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes including this issue.

The vulnerability allows unauthorized access to critical and potentially all data accessible through Oracle XML Gateway, compromising confidentiality. It also permits an attacker to cause a partial denial of service, impacting availability. There is no impact on data integrity. The attack requires network access via HTTP and low privileges, making it relatively easy to exploit in affected versions.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.