This vulnerability affects Oracle Application Object Library component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 base score is 5.4, reflecting low complexity attack vector with low privileges required and no user interaction. The vulnerability is classified under CWE-284 (Improper Access Control). The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Application Object Library. This compromises confidentiality and integrity of affected data but does not impact availability. The attacker requires network access and low privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate vulnerabilities. Until a patch is confirmed, restrict network access to the Oracle Application Object Library interface where possible and monitor for unusual activity.