This vulnerability affects the Oracle E-Business Intelligence component (Definition) within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It enables a low privileged attacker with network access over HTTP to gain unauthorized access that can result in creation, deletion, or modification of critical or all accessible data within Oracle E-Business Intelligence. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts, with no impact on availability. The vendor advisory from Oracle's July 2026 Critical Patch Update references this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue. Oracle strongly recommends applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle E-Business Intelligence. Confidentiality and integrity of data are highly impacted, potentially allowing attackers to fully compromise data integrity and confidentiality within the affected product. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

The vendor advisory does not explicitly confirm the availability of a patch or fix for this vulnerability. Oracle recommends that customers remain on actively supported versions and apply security patches promptly as part of their Critical Patch Update process. Users should monitor Oracle's official security alerts and apply any relevant patches once available. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.