This vulnerability affects Oracle SDP Number Portability within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access over HTTP to compromise the product by unauthorized modification (update, insert, delete) of some accessible data and to cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can lead to unauthorized modification of data within Oracle SDP Number Portability and partial denial of service, affecting data integrity and availability. Confidentiality is not impacted. The attack requires network access and low privileges, making it moderately accessible to attackers.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory.