This vulnerability affects Oracle Enterprise Asset Management component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP by an attacker with low privileges and no user interaction. Successful exploitation can lead to unauthorized access to critical or all accessible data and partial denial of service conditions. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 security patches and strongly recommends applying these patches promptly. No specific patch version or fix details are provided in the advisory excerpt, so patch status is not explicitly confirmed.

Exploitation can result in unauthorized access to critical or all accessible data within Oracle Enterprise Asset Management and can cause a partial denial of service. The confidentiality impact is high, while availability impact is low. Integrity is not impacted according to the CVSS vector. The vulnerability can be exploited remotely over HTTP by a low privileged attacker without user interaction.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses this vulnerability among others. Until patches are applied, risk may be reduced by blocking network protocols required by an attack or removing unnecessary privileges from users. However, these mitigations may impact application functionality. No official fix version is explicitly stated in the advisory content provided; therefore, patch status is not yet confirmed. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.