This vulnerability affects Oracle Common Application Components within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the components. The scope of impact extends beyond the immediate component, potentially affecting additional Oracle products. Exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data within the components, and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) reflects network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact with low availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation level for it.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Common Application Components, unauthorized access to all accessible data in these components, and partial denial of service conditions. The vulnerability impacts confidentiality, integrity, and availability, with a high overall severity score of 8.4. The scope of the vulnerability extends beyond the immediate component, potentially affecting other Oracle products that rely on these components.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or remediation level for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, organizations should consider restricting network access to Oracle Common Application Components to trusted sources and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.