This vulnerability exists in the Internal Operations component of Oracle Contracts within Oracle E-Business Suite versions 12.2.14 to 12.2.15. It is easily exploitable by an attacker with high privileges and network access over HTTP, potentially allowing complete compromise of Oracle Contracts. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous security patches across multiple products. Oracle strongly recommends applying these patches without delay to mitigate exploitation risks.

An attacker with high privileges and network access via HTTP can exploit this vulnerability to fully compromise Oracle Contracts. This includes complete loss of confidentiality, integrity, and availability of the affected product. The impact severity is high, as it can lead to takeover of Oracle Contracts, potentially affecting business operations relying on this software.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the relevant patches for Oracle Contracts versions 12.2.14 through 12.2.15 immediately to remediate the issue. Oracle emphasizes the importance of staying on actively supported versions and applying security patches promptly to prevent exploitation. No alternative mitigations or workarounds are indicated in the advisory.