This vulnerability affects Oracle Applications DBA component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker who has logon access to the infrastructure to compromise Oracle Applications DBA, potentially gaining unauthorized access to critical or all accessible data. The CVSS 3.1 vector indicates local attack vector with low complexity and low privileges required, no user interaction, and a scope change with high confidentiality impact but no integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle advises customers to remain on supported versions and apply security patches without delay.

Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Applications DBA. The vulnerability affects confidentiality significantly but does not impact integrity or availability. The scope change indicates that the attack could affect additional Oracle products beyond Oracle Applications DBA.

Oracle's advisory does not explicitly confirm a patch or remediation level for this vulnerability. Customers should review the July 2026 Critical Patch Update advisory and apply all relevant security patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate risks. No vendor advisory states that no action is required or that the issue is already mitigated.