CVE-2026-22011 affects the Oracle Applications DBA product within Oracle E-Business Suite (versions 12.2.3 to 12.2.15). The vulnerability is difficult to exploit and requires a high privileged attacker with network access via HTTP and human interaction from a person other than the attacker. Exploitation can result in complete compromise of Oracle Applications DBA and may affect other Oracle products due to scope change. The CVSS 3.1 score is 7.6, reflecting high impact on confidentiality, integrity, and availability. Oracle’s April 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability for this specific CVE. Customers are advised to apply the Critical Patch Update without delay to mitigate this and other vulnerabilities.

Successful exploitation of CVE-2026-22011 can lead to takeover of Oracle Applications DBA, compromising confidentiality, integrity, and availability of the affected system. The vulnerability requires a high privileged attacker with network access and human interaction, which limits exploitability but still poses a significant risk. Additionally, the vulnerability’s scope change means that other Oracle products may be impacted as a result of exploitation. There are no known exploits in the wild at this time.

Oracle’s April 2026 Critical Patch Update advisory strongly recommends applying the provided security patches promptly. Although the advisory does not explicitly confirm patch availability for CVE-2026-22011, it is part of the cumulative Critical Patch Update. Therefore, customers should review the advisory and apply the April 2026 Critical Patch Update to mitigate this vulnerability. Patch status is not explicitly confirmed for this CVE; users must consult the Oracle advisory for the latest remediation guidance. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.