This vulnerability affects Oracle Document Management and Collaboration within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is easily exploitable by unauthenticated attackers over the network via HTTP, enabling full compromise of the affected product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the impact includes complete loss of confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation allows an unauthenticated attacker with network access to take over Oracle Document Management and Collaboration, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized data access, modification, and service disruption.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the relevant patches for Oracle Document Management and Collaboration versions 12.2.3 through 12.2.15 immediately. Oracle emphasizes the importance of staying on actively supported versions and applying security patches promptly to prevent exploitation.