This vulnerability in Oracle Complex Maintenance, Repair and Overhaul (Oracle E-Business Suite component Common Utilities) affects versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized update, insert, or delete capabilities on some accessible data, and unauthorized read access to a subset of accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts (CVSS 5.4). The vulnerability is classified under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for this product and version. Oracle strongly recommends applying patches promptly and maintaining supported versions to mitigate risks.

Successful exploitation can lead to unauthorized modification (update, insert, delete) of some data and unauthorized reading of a subset of data within Oracle Complex Maintenance, Repair and Overhaul. This compromises data confidentiality and integrity but does not affect availability. The attacker requires network access via HTTP and low privileges, making the vulnerability relatively easy to exploit in environments where the product is accessible over the network.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches without delay and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected Oracle Complex Maintenance, Repair and Overhaul service to trusted users only, and monitor for suspicious activity related to unauthorized data access or modification.