This vulnerability affects Oracle Demand Signal Repository, a component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It permits a low-privileged attacker with network access over HTTP to gain unauthorized capabilities to create, delete, or modify critical data within the repository. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without affecting availability. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security patches across multiple products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Demand Signal Repository, compromising data confidentiality and integrity. This could affect all data accessible through the repository, potentially impacting business operations relying on this data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using affected versions (12.2.3 through 12.2.15) should apply the official patch without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified.