This vulnerability exists in the Oracle Engineering product of Oracle E-Business Suite, specifically in the Change Management component. It is exploitable remotely over the network via HTTP by an attacker with low privileges, allowing compromise of Oracle Engineering. The vulnerability has a CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Engineering. The affected versions are 12.2.3 through 12.2.15 inclusive. Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

The vulnerability allows unauthorized access to critical data or complete access to all data accessible by Oracle Engineering. It impacts confidentiality severely but does not affect integrity or availability. The scope change means that exploitation could affect additional Oracle products beyond Oracle Engineering. The high CVSS score reflects the significant risk of data compromise if exploited.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the relevant patches from this update promptly to remediate the issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. No additional mitigation steps are specified beyond patching.