This vulnerability affects Oracle U.S. Federal Financials component Internal Operations in Oracle E-Business Suite versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access over HTTPS can exploit this difficult-to-exploit vulnerability to compromise the product, resulting in unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 score of 6.8 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating network attack vector, high attack complexity, no privileges or user interaction required, scope change, and high confidentiality impact. The vulnerability may also affect other Oracle products due to scope change. No known exploits in the wild have been reported. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle U.S. Federal Financials. There is no impact on integrity or availability. The vulnerability is difficult to exploit and requires network access via HTTPS. The scope of impact may extend to additional Oracle products beyond U.S. Federal Financials.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory. Monitor Oracle's official channels for updates on patch availability.