This vulnerability affects Oracle Contract Lifecycle Management for Public Sector version 16, specifically within the ECC For Award and IDV component of Oracle E-Business Suite. It is exploitable remotely over HTTP by an attacker with low privileges, without requiring user interaction. Successful exploitation can lead to complete compromise of the affected product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across various products. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

An attacker with network access and low privileges can exploit this vulnerability to fully compromise Oracle Contract Lifecycle Management for Public Sector version 16. This includes complete loss of confidentiality, integrity, and availability of the affected system, potentially allowing takeover of the application.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the relevant patches from this update promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.