This vulnerability affects Oracle Engineering component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable by a low privileged attacker with network access over HTTP, though exploitation is considered difficult. The vulnerability allows unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by Oracle Engineering. The scope of impact extends beyond Oracle Engineering to additional Oracle products. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts without availability impact. Oracle's September 2026 Critical Security Patch Update includes patches addressing this vulnerability. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Engineering and unauthorized access to all Oracle Engineering accessible data. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond Oracle Engineering. The confidentiality and integrity of data are highly impacted, but availability is not affected. The vulnerability is rated high severity with a CVSS 3.1 base score of 8.2.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these security patches promptly to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and applying all available security patches without delay. No other specific mitigations are indicated by the vendor advisory.