This vulnerability affects Oracle Application Object Library component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is exploitable remotely over the network via HTTP by an attacker with low privileges, though it is considered difficult to exploit. The impact of a successful attack includes full compromise of the Oracle Application Object Library, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability and provides patches as part of a cumulative update. No direct exploit in the wild is currently known.

If exploited, this vulnerability allows an attacker with low privileges and network access via HTTP to take over the Oracle Application Object Library component. This results in complete compromise of confidentiality, integrity, and availability of the affected component, potentially leading to unauthorized data access, modification, and service disruption.

Oracle has released patches addressing this vulnerability in the July 2026 Critical Patch Update. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. No vendor advisory indicates that no action is required or that the issue is already mitigated without patching. Patch status is confirmed by the vendor advisory. There is no indication that this is a cloud service; therefore, patching must be performed by the customer on affected on-premises installations.