This vulnerability affects Oracle In-Memory Cost Management for Discrete Industries within Oracle E-Business Suite versions 12.2.12 to 12.2.15. It is exploitable remotely over HTTPS without authentication, allowing attackers to gain unauthorized access to critical data and perform unauthorized data creation, deletion, or modification. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle’s June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes and strongly urges customers to apply patches promptly. No explicit patch or remediation level is stated in the advisory content provided, but the recommendation is to apply the Critical Security Patch Update without delay.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle In-Memory Cost Management for Discrete Industries, as well as unauthorized access to all accessible data in this product. The confidentiality and integrity of data are severely impacted, but availability is not affected. This could compromise business operations relying on this Oracle E-Business Suite component.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability along with others. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to vulnerable packages from users. However, these workarounds may disrupt application functionality. No official fix status is explicitly stated in the advisory content provided, so customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.