This vulnerability affects Oracle Contract Lifecycle Management for Public Sector within Oracle E-Business Suite, specifically versions 12.2.8 to 12.2.15. It enables an attacker with low privileges and network access over HTTP to compromise the system, potentially leading to unauthorized access to critical data and limited unauthorized modification capabilities. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability, emphasizing the importance of applying these patches promptly.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Contract Lifecycle Management for Public Sector. Additionally, attackers may gain unauthorized ability to update, insert, or delete some accessible data. The confidentiality impact is high, integrity impact is low, and availability is not affected. This could lead to data breaches and unauthorized data manipulation within affected systems.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Contract Lifecycle Management for Public Sector versions 12.2.8 through 12.2.15 without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to mitigate exploitation risks. No alternative mitigations or workarounds are specified in the advisory.