This vulnerability affects Oracle Enterprise Asset Management component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized update, insert, delete, and read access to certain accessible data within the product. The vulnerability is rated with a CVSS 3.1 score of 4.2, indicating a medium severity with low confidentiality and integrity impacts and no availability impact. The attack complexity is high, requiring network access and low privileges, with no user interaction needed. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state a remediation level or patch availability for this specific issue. Oracle advises customers to remain on actively supported versions and apply security patches without delay.

Successful exploitation can result in unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data within Oracle Enterprise Asset Management. The confidentiality and integrity of some data may be compromised, but availability is not affected. The vulnerability requires network access via HTTP and is difficult to exploit, limiting the risk to some extent. There are no known active exploits in the wild.

Oracle's advisory does not explicitly confirm patch availability or remediation level for this specific vulnerability. Customers are strongly advised to review the July 2026 Critical Patch Update advisory and apply all relevant security patches promptly to mitigate this and other vulnerabilities. Since the vulnerability affects on-premises software, organizations should ensure they are running supported versions and have applied the latest Critical Patch Updates from Oracle. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.