This vulnerability affects Oracle Enterprise Asset Management component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to gain unauthorized update, insert, delete, and read access to some accessible data within the product. The CVSS 3.1 base score is 4.2, reflecting low confidentiality and integrity impacts and no availability impact. The attack complexity is high, requiring network access and low privileges, with no user interaction needed. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability but does not explicitly state patch availability or remediation status for it. No known exploits have been reported in the wild.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Enterprise Asset Management. The impact is limited to confidentiality and integrity with no impact on availability. The vulnerability is considered medium severity based on CVSS 3.1 scoring.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance. Oracle strongly recommends applying security patches promptly for all supported products. Until an official patch is confirmed and applied, limit network access to Oracle Enterprise Asset Management interfaces and monitor for unusual activity consistent with unauthorized data access attempts.