This vulnerability affects Oracle Application Object Library component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with low privileges and network access over HTTPS. Exploitation can result in unauthorized creation, deletion, or modification of critical data, and unauthorized access to all data accessible by the Oracle Application Object Library. The vulnerability has a CVSS 3.1 score of 9.6 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. The vulnerability may also affect other Oracle products due to scope change. Oracle has published a Critical Patch Update advisory for July 2026 referencing this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue.

Successful exploitation allows an attacker with low privileges and network access to gain unauthorized creation, deletion, or modification access to critical data within Oracle Application Object Library. It also enables unauthorized access to all data accessible by this component. The vulnerability affects confidentiality and integrity severely, but does not impact availability. Due to scope change, other Oracle products may also be significantly impacted.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the vendor advisory does not explicitly confirm the availability of a specific patch or remediation level for this vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant security patches promptly. Patch status is not yet confirmed for this specific vulnerability — check the vendor advisory for current remediation guidance. Maintaining up-to-date patches and using supported versions is recommended.