A vulnerability exists in the Oracle Advanced Benefits product of Oracle E-Business Suite, specifically in the Self-serv What-if Analysis component. It affects supported versions 12.2.3 through 12.2.15. The vulnerability requires high privileges and network access via HTTP to exploit and can lead to a complete takeover of Oracle Advanced Benefits. The CVSS 3.1 base score is 8.0, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides fixes for affected products.