This vulnerability affects Oracle Project Foundation component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized modification (update, insert, delete) and unauthorized read access to some data, as well as the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized data manipulation (update, insert, delete) and unauthorized reading of some Oracle Project Foundation data. Additionally, it can cause a partial denial of service affecting availability. The impact is limited to a subset of data and partial service disruption, consistent with the medium CVSS score of 6.3.

The vendor advisory from Oracle (https://www.oracle.com/security-alerts/cpujul2026.html) does not explicitly confirm patch availability or remediation level for this specific vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly and remaining on actively supported versions. Until a patch is confirmed, monitor Oracle advisories for updates and apply any released patches without delay.