This vulnerability affects Oracle Product Workbench within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 score of 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). Exploitation may also impact additional Oracle products due to scope change. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 others across multiple product families.

Successful exploitation can lead to complete compromise of Oracle Product Workbench, affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means other Oracle products may also be impacted indirectly. The attack requires network access via HTTP and low privileges, but the complexity of exploitation is high.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches without delay to mitigate the risk. Oracle emphasizes remaining on actively-supported versions and promptly applying security patches. No additional mitigation steps are specified beyond patching.