A vulnerability exists in the Oracle Contracts product of Oracle E-Business Suite versions 12.2.14 and 12.2.15. This flaw allows a high privileged attacker with network access via HTTP to compromise Oracle Contracts, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly to mitigate the risk.