This vulnerability affects Oracle Cost Management component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to perform unauthorized actions such as creating, deleting, or modifying critical data, or gaining unauthorized access to all data accessible by Oracle Cost Management. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches across Oracle products but does not explicitly confirm patch availability or remediation level for this specific vulnerability. Patch status is therefore not yet confirmed and should be verified with the vendor advisory.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Cost Management, as well as unauthorized access to all data accessible by this product. This compromises confidentiality and integrity of sensitive business data managed by Oracle Cost Management. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Cost Management interfaces to trusted users only and monitor for suspicious activity related to unauthorized data access or modification.