This vulnerability affects Oracle Report Manager component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation results in unauthorized access to critical or all accessible data within Oracle Report Manager and can cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

The vulnerability allows unauthorized access to critical or all data accessible by Oracle Report Manager, compromising confidentiality. It also enables an attacker to cause a partial denial of service, impacting availability. There is no reported impact on integrity. The vulnerability is remotely exploitable by a low-privileged attacker without user interaction.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches promptly to remediate this issue. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation.