This vulnerability affects Oracle Enterprise Asset Management component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It requires a high privileged attacker with network access via HTTP and does not require user interaction. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS vector indicates network attack vector (AV:N), high attack complexity (AC:H), high privileges required (PR:H), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality and integrity impacts (C:H/I:H) with no availability impact (A:N). The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability within the provided content.

Successful exploitation could allow an attacker with high privileges and network access to manipulate or access critical data within Oracle Enterprise Asset Management, potentially compromising data integrity and confidentiality. There is no indication of availability impact. No known exploits have been reported in the wild.

Oracle strongly recommends applying the latest Critical Patch Update from July 2026, which includes numerous security patches across Oracle products. Customers should remain on actively-supported versions and apply security patches without delay. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, check the Oracle July 2026 Critical Patch Update advisory for the latest remediation information.