This vulnerability affects Oracle Interaction Blending component of Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker who has logon access to the underlying infrastructure to compromise Oracle Interaction Blending. The compromise can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates local attack vector with low attack complexity, requiring low privileges and no user interaction, impacting confidentiality and integrity at a high level but not availability. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue. No known exploits in the wild have been reported.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle Interaction Blending. This compromises confidentiality and integrity of sensitive data managed by the product. There is no impact on availability reported.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until a patch is confirmed and applied, restrict access to the infrastructure hosting Oracle Interaction Blending to trusted users only to reduce risk.