This vulnerability affects Oracle Bills of Material in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by a low privileged attacker with network access via HTTP, enabling unauthorized creation, deletion, or modification of critical data accessible through Oracle Bills of Material. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Bills of Material, as well as unauthorized access to all data accessible through this component. This compromises both confidentiality and integrity of the affected data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the relevant patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15 as soon as possible. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this and other vulnerabilities. Patch status is confirmed as available via the vendor advisory.