This vulnerability affects Oracle Application Object Library component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized update, insert, or delete capabilities on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impact with no availability impact. The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but recommends applying Critical Patch Updates regularly. No known exploits have been reported in the wild.

Successful exploitation can lead to unauthorized read access to some data and unauthorized modification (update, insert, delete) of some Oracle Application Object Library accessible data. This compromises confidentiality and integrity of affected data but does not impact system availability. The vulnerability requires network access and low privileges, making it relatively easy to exploit if the attacker has HTTP access.

Oracle's advisory does not explicitly confirm a patch or remediation level for this vulnerability. However, Oracle strongly recommends that customers remain on actively supported versions and apply Critical Patch Updates without delay. Users of Oracle Application Object Library versions 12.2.3 through 12.2.15 should monitor Oracle's official security alerts and apply relevant patches from the July 2026 Critical Patch Update or subsequent updates as they become available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.