This vulnerability affects the Pasta component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is exploitable by an attacker who already has high privileged access to the infrastructure hosting Pasta, enabling compromise and potential takeover of the Pasta product. The CVSS 3.1 vector indicates the attack requires local access (AV:L), low attack complexity (AC:L), high privileges (PR:H), no user interaction (UI:N), and impacts confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state patch availability or remediation instructions for Pasta. Customers are urged to apply Oracle Critical Patch Updates promptly to mitigate vulnerabilities.

Successful exploitation allows a high privileged attacker with logon access to the infrastructure to fully compromise the Pasta product, impacting confidentiality, integrity, and availability. This could lead to complete takeover of the Pasta component within Oracle E-Business Suite. There are no reports of known exploits in the wild currently.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or provide specific remediation instructions for Pasta. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply any relevant patches promptly. Until a patch is confirmed, ensure that only trusted, high privileged users have access to the infrastructure hosting Pasta to reduce risk.