This vulnerability affects Oracle Financials Common Modules within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the module, leading to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through these modules. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle's official advisory for the September 2026 Critical Security Patch Update includes patches for this vulnerability among 673 others, emphasizing the importance of applying these updates promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Financials Common Modules, or unauthorized access to all data accessible by these modules. This compromises confidentiality and integrity of sensitive financial data. There is no reported impact on availability. The vulnerability is exploitable over the network with low complexity and requires only low privileges, increasing the risk.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches without delay to remediate this vulnerability. Oracle emphasizes remaining on actively-supported versions and promptly applying security patches to prevent exploitation. Patch status is confirmed as available via the official Oracle advisory.