This vulnerability affects Oracle One-to-One Fulfillment within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable by an attacker with low privileges who has access to the physical communication segment of the hardware where the product runs. Successful exploitation can lead to full takeover of the Oracle One-to-One Fulfillment component, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting attack via adjacent network with low attack complexity and privileges required, no user interaction, and high impact on all security properties. Oracle has released patches for this vulnerability as part of its September 2026 Critical Security Patch Update, which includes 673 security fixes across multiple products. Customers are urged to apply these patches without delay.

An attacker with low privileges and access to the physical communication segment can exploit this vulnerability to take over the Oracle One-to-One Fulfillment product. This results in complete compromise of confidentiality, integrity, and availability of the affected component. The high CVSS score (8.0) reflects the critical nature of the impact on the product's security posture.

Oracle has released a security patch addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the official Oracle patches promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying all security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.