A vulnerability exists in the Oracle Alert product of Oracle E-Business Suite versions 12.2.3 through 12.2.15. This flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Alert, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with significant confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.