This vulnerability affects Oracle Enterprise Asset Management component of Oracle E-Business Suite in versions 12.2.3 through 12.2.15. It permits an attacker with low privileges and network access via HTTP to compromise the system by unauthorized modification and reading of accessible data. Exploitation requires human interaction from a user other than the attacker and can cause a scope change impacting other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and limited confidentiality and integrity impact without affecting availability. No known exploits in the wild have been reported. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm patch availability for this specific vulnerability.

Successful exploitation can lead to unauthorized update, insert, or delete access to some Oracle Enterprise Asset Management data, as well as unauthorized read access to a subset of accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates potential impact on additional Oracle products beyond Enterprise Asset Management. Exploitation requires user interaction from a person other than the attacker, limiting automated exploitation.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit network access to Oracle Enterprise Asset Management and educate users to avoid interaction with untrusted content that could trigger exploitation.