This vulnerability exists in the Self-serv What-if Analysis component of Oracle Advanced Benefits within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit and requires a high privileged attacker with network access via HTTP. Successful exploitation can lead to complete compromise of Oracle Advanced Benefits and may impact other Oracle products. The vulnerability is scored 8.0 on the CVSS 3.1 scale with network attack vector, high attack complexity, high privileges required, no user interaction, and scope change, resulting in high confidentiality, integrity, and availability impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can result in full takeover of Oracle Advanced Benefits, impacting confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products may also be significantly affected by attacks leveraging this vulnerability. The vulnerability requires a high privileged attacker with network access, making it less trivial to exploit but still serious given the potential impact.

Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability. Customers should apply the relevant patches for Oracle Advanced Benefits versions 12.2.3 through 12.2.15 as soon as possible. Oracle strongly recommends remaining on actively supported versions and applying security patches promptly to mitigate this and other vulnerabilities. Patch status is confirmed as available via the vendor advisory.