This vulnerability affects Oracle Contract Lifecycle Management for Public Sector (component: Wage Determination Online) in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an unauthenticated attacker with network access via HTTP to compromise the product by leveraging user interaction from a third party. Successful exploitation can lead to unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products. Customers are strongly advised to apply the available patches promptly.

Successful exploitation can result in unauthorized read access to some data and unauthorized update, insert, or delete access to some accessible data within Oracle Contract Lifecycle Management for Public Sector. The vulnerability requires user interaction from a person other than the attacker and affects confidentiality and integrity but not availability. The scope of impact may extend beyond the initially affected product.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the relevant security patches for Oracle Contract Lifecycle Management for Public Sector versions 12.2.3 through 12.2.15 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks.