This vulnerability affects Oracle Demand Signal Repository, a component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can result in unauthorized access to critical data, including the ability to create, delete, or modify data within the repository. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impact. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities.

The vulnerability allows unauthorized access and modification of critical data within Oracle Demand Signal Repository, potentially compromising the confidentiality and integrity of all accessible data. There is no impact on availability. This could lead to significant data breaches or unauthorized data manipulation if exploited.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Demand Signal Repository versions 12.2.3 through 12.2.15 are strongly advised to apply the patch promptly to remediate the vulnerability. Oracle recommends staying on actively supported versions and applying security patches without delay to prevent exploitation.