A vulnerability exists in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3 through 12.2.15. This vulnerability allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data within Oracle Sales Offline. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity due to confidentiality impact. Oracle has released a Critical Security Patch Update in September 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly to mitigate this risk.