Executive brief
Oracle Contracts is a contract management component within Oracle E-Business Suite, used for managing business agreements and contract lifecycle. An attacker with high-level administrative privileges and network access can exploit this vulnerability to gain complete control of the Contracts system, affecting the confidentiality, integrity, and availability of all contract data and operations.
Technical details
This vulnerability in Oracle Contracts' Internal Operations component allows a high-privileged attacker with network access via HTTP to achieve unauthorized system compromise. The vulnerability is easily exploitable and requires only high privilege level access (no complex attack setup needed). Successful exploitation results in complete takeover of the Oracle Contracts application, compromising all three security properties: confidentiality (data exposure), integrity (data modification), and availability (system disruption). The vulnerability affects Oracle E-Business Suite versions 12.2.14 through 12.2.15.
Affected products
- Oracle E-Business Suite - Contracts 12.2.14-12.2.15
Timeline
- 2026-09-15: disclosed