This vulnerability exists in the Internal Operations component of Oracle Financials for Asia/Pacific within Oracle E-Business Suite versions 12.2.8 to 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability. Oracle emphasizes the importance of applying these patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Financials for Asia/Pacific. Attackers can gain unauthorized access to all data accessible by the application and cause partial denial of service. This impacts confidentiality, integrity, and availability of the affected system, potentially leading to significant operational and data security risks.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the relevant patches for Oracle Financials for Asia/Pacific versions 12.2.8 through 12.2.15 as soon as possible. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks.