A vulnerability exists in the Oracle Web Applications Desktop Integrator component of Oracle E-Business Suite, specifically in the file download functionality. This flaw affects supported versions from 12.2.3 through 12.2.15. It allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data within the application. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with a high confidentiality impact but no impact on integrity or availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected versions. Oracle strongly recommends applying these patches promptly to mitigate the risk. No known exploits in the wild have been reported to date.