This vulnerability in Oracle Scheduler (component: Rules UI) of Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows an attacker with low privileges and network access via HTTP to compromise the scheduler. Successful exploitation can lead to unauthorized modification (update, insert, delete) of some accessible data, unauthorized read access to a subset of data, and partial denial of service conditions. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability.

The vulnerability enables unauthorized update, insertion, or deletion of some Oracle Scheduler accessible data, unauthorized read access to a subset of that data, and the ability to cause a partial denial of service on Oracle Scheduler. This could affect the integrity, confidentiality, and availability of Oracle Scheduler data and services to a limited extent.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. No explicit patch or workaround details are provided in the advisory content for this specific vulnerability at this time.