This vulnerability affects Oracle Complex Maintenance, Repair and Overhaul component of Oracle E-Business Suite versions 12.2.12 through 12.2.15. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by the product, as well as partial denial of service. The vulnerability has a CVSS 3.1 score of 8.5 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted fixes for this and other vulnerabilities.

Exploitation of this vulnerability can result in unauthorized access to critical data within Oracle Complex Maintenance, Repair and Overhaul, potentially extending impact to additional Oracle products due to scope change. It can also cause a partial denial of service affecting availability. The confidentiality impact is high, while integrity impact is not affected, and availability impact is low.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using affected versions (12.2.12 through 12.2.15) should apply the relevant patches promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.