This vulnerability affects Oracle Bills of Material component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can lead to unauthorized access to all data accessible by Oracle Bills of Material and partial denial of service. The vulnerability has a CVSS 3.1 score of 8.5 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability may also affect other Oracle products due to scope change. Oracle has released a Critical Security Patch Update in September 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly.

Exploitation of this vulnerability can result in unauthorized access to critical data within Oracle Bills of Material and potentially other Oracle products due to scope change. It can also cause a partial denial of service affecting availability. The confidentiality impact is high, while integrity impact is none and availability impact is low. This could compromise sensitive business data and disrupt operations relying on Oracle Bills of Material.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.