This vulnerability affects Oracle Assets in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It enables a low privileged attacker with network access over HTTP to compromise Oracle Assets, potentially leading to unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact. Oracle's September 2026 Critical Security Patch Update includes a patch for this vulnerability among 673 security fixes across multiple products. Oracle strongly recommends applying these patches promptly to mitigate exploitation risks.

Successful exploitation can result in unauthorized access to critical or all accessible data within Oracle Assets, compromising confidentiality. There is no impact on integrity or availability. The vulnerability requires low privileges and network access via HTTP, making it relatively easy to exploit. No known exploits in the wild have been reported as of the advisory date.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the provided patches without delay to remediate this issue. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.