This vulnerability exists in the Internal Operations component of Oracle Enterprise Asset Management within Oracle E-Business Suite. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can result in complete compromise of the Oracle Enterprise Asset Management system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update advisory listing many patches but does not explicitly confirm a patch or remediation level for this CVE. The affected versions explicitly stated include 12.2.3, with the description indicating versions 12.2.3 through 12.2.15 are affected.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain full control over Oracle Enterprise Asset Management. This compromises confidentiality, integrity, and availability of the affected system, potentially allowing unauthorized data access, modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to mitigate vulnerabilities. Until a specific patch is confirmed, restrict network access to Oracle Enterprise Asset Management and monitor for unusual activity consistent with exploitation attempts.