This vulnerability affects Oracle Bills of Material component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible through Oracle Bills of Material. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products. Oracle strongly recommends applying these patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Bills of Material, as well as unauthorized access to all data accessible through this product. This compromises data confidentiality and integrity but does not affect availability. The vulnerability is exploitable remotely over the network with low attack complexity and requires low privileges, increasing the risk of compromise if unpatched.

Oracle has released a Critical Security Patch Update that includes a fix for this vulnerability. Customers should apply the September 2026 Critical Security Patch Update promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigations are specified by Oracle beyond patching.