This vulnerability affects Oracle Order Management, part of Oracle E-Business Suite, specifically version 16. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized access to critical data and the ability to modify some data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous patches across many products. The vendor strongly recommends applying patches promptly to mitigate exploitation risks.

Successful exploitation can lead to unauthorized access to sensitive and critical data within Oracle Order Management and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the system's data, potentially affecting business operations relying on this data.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches without delay. The vendor advisory does not indicate that the vulnerability is already mitigated or requires no action. Patch status is confirmed as available via the Critical Security Patch Update. Users should refer to Oracle's official advisory and patch documentation for installation instructions.