This vulnerability affects Oracle Mobile Application Server component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit this flaw, which requires user interaction from a third party, to cause a hang or repeated crash resulting in denial of service. Additionally, the attacker can gain unauthorized ability to update, insert, or delete some data accessible by the server. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H, indicating network attack vector, low attack complexity, no privileges required, required user interaction, scope change, no confidentiality impact, low integrity impact, and high availability impact. The vulnerability may also affect other Oracle products due to scope change.

Successful exploitation can cause a complete denial of service by hanging or repeatedly crashing the Oracle Mobile Application Server. It also allows unauthorized modification of some data accessible by the server, impacting data integrity. The vulnerability affects the availability and integrity of the system but does not impact confidentiality. The scope change means additional Oracle products may be affected beyond the Mobile Application Server itself.

Oracle has released security patches addressing this vulnerability as part of their September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the vendor advisory. No indication of 'no action required' or 'already mitigated' was provided.