This vulnerability affects Oracle Application Object Library, a component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access over HTTPS to compromise the library, potentially resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability also has scope change implications, meaning it can significantly impact other Oracle products beyond the Application Object Library itself. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Application Object Library and potentially other Oracle products due to scope change. Confidentiality and integrity of data are severely impacted, but availability is not affected. This could compromise sensitive business data and operations relying on the Oracle Application Object Library.

The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability. Patch status is not yet confirmed — check the Oracle Critical Patch Update Advisory for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions to mitigate exploitation risks.