This vulnerability affects the Oracle Mobile Application Server component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits an unauthenticated attacker with network access via TCP to compromise the server, resulting in unauthorized access to critical or all accessible data and the ability to cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability among many others.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Mobile Application Server and can cause a partial denial of service condition. The confidentiality impact is high, while availability impact is low. There is no integrity impact reported. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches promptly to remediate this issue. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as fixed in the September 2026 Critical Security Patch Update. No additional mitigation steps are indicated beyond applying the official patch.