This vulnerability affects Oracle Demand Signal Repository within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP by an attacker with low privileges, allowing unauthorized modification of critical data and denial of service through system hangs or crashes. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and other vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Demand Signal Repository, compromising data integrity. Additionally, attackers can cause the system to hang or crash repeatedly, resulting in a complete denial of service. There is no confidentiality impact reported. The vulnerability poses a high risk to the integrity and availability of affected systems.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using affected versions (12.2.3 through 12.2.15) should apply these patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.