This vulnerability affects Oracle Complex Maintenance, Repair and Overhaul within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTPS by an attacker with low privileges, enabling compromise of the affected product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches. Oracle emphasizes the importance of applying these patches without delay to prevent exploitation.

Successful exploitation can lead to complete takeover of Oracle Complex Maintenance, Repair and Overhaul, impacting confidentiality, integrity, and availability of the system. This could allow attackers to execute unauthorized actions, access sensitive data, or disrupt operations within the affected Oracle E-Business Suite component.

Oracle has released security patches as part of the September 2026 Critical Security Patch Update that address this vulnerability. Customers should apply the relevant patches for Oracle Complex Maintenance, Repair and Overhaul versions 12.2.3 through 12.2.15 promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to mitigate this and other vulnerabilities. Patch status is confirmed as fixed in the September 2026 update.