This vulnerability affects Oracle Contract Lifecycle Management for Public Sector within Oracle E-Business Suite, specifically versions 12.2.13 to 12.2.15. It permits a low privileged attacker with network access via HTTP to exploit the flaw and compromise the system, potentially resulting in complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privilege required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for this and many other vulnerabilities.

Successful exploitation can lead to full compromise of Oracle Contract Lifecycle Management for Public Sector, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected application, potentially leading to unauthorized access, data manipulation, and service disruption.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. No additional mitigation steps are indicated beyond applying the official patch.