This vulnerability affects Oracle Demand Signal Repository within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low-privileged attacker with network access over HTTP to compromise the system, enabling unauthorized creation, deletion, or modification of critical data and causing repeated crashes leading to denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. Oracle has included fixes for this vulnerability in its September 2026 Critical Security Patch Update (CSPU).

Successful exploitation can lead to unauthorized modification or deletion of critical data within Oracle Demand Signal Repository and cause repeated crashes resulting in denial of service. There is no confidentiality impact reported. The integrity and availability of the affected system are severely impacted.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond applying the official patches.