This vulnerability affects Oracle Order Management within Oracle E-Business Suite, specifically versions 12.2.4 to 12.2.15. It permits a low privileged attacker with network access via HTTP to exploit the system without user interaction, resulting in unauthorized access to critical data and the ability to create, delete, or modify such data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Order Management, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches promptly to remediate this issue. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No additional mitigation steps are specified beyond applying the official patch.