This vulnerability affects Oracle Content Manager component Cover Letter in Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized ability to read, update, insert, or delete some accessible data and to cause partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm a patch or remediation level for it. Oracle strongly recommends applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized read access to some data, unauthorized modification (update, insert, delete) of some data, and partial denial of service of Oracle Content Manager. The confidentiality, integrity, and availability impacts are rated low but combined result in a medium severity vulnerability. There are no reports of known exploits in the wild at this time.

Oracle's advisory does not explicitly state a patch or remediation level for this specific vulnerability. Customers should review the Oracle Critical Patch Update for July 2026 and apply all relevant security patches promptly as recommended by Oracle. Maintaining up-to-date patching is the primary mitigation. No vendor advisory states that no action is required or that the vulnerability is already mitigated.