This vulnerability affects Oracle Assets component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise Oracle Assets, resulting in unauthorized creation, deletion, or modification of critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly mention a patch for this specific vulnerability but strongly urges customers to apply available security patches without delay. The vulnerability is listed among many addressed in the July 2026 CPU, but no direct patch link or remediation level is provided in the input data.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle Assets, compromising confidentiality and integrity of the system. This could lead to significant data breaches or unauthorized data manipulation within Oracle Assets. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying all relevant Critical Patch Updates promptly to mitigate this and other vulnerabilities. Until a patch is confirmed, restrict network access to Oracle Assets interfaces to trusted users and monitor for suspicious activity consistent with unauthorized data access or modification.