This vulnerability affects Oracle Depot Repair component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a high privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Depot Repair. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation allows a high privileged attacker with network access to gain unauthorized creation, deletion, or modification access to critical data or all data accessible by Oracle Depot Repair. This can lead to significant confidentiality and integrity breaches of critical business data managed by the product. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional vendor-recommended mitigations or workarounds are specified in the advisory.