This vulnerability affects Oracle Application Object Library component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the application by unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data, as well as causing a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple products but does not explicitly confirm patch availability or remediation level for this specific vulnerability.

Successful exploitation can lead to unauthorized data modification (update, insert, delete) and unauthorized data disclosure of some Oracle Application Object Library accessible data. Additionally, it can cause a partial denial of service affecting availability. The impact is rated as medium severity with a CVSS 3.1 base score of 6.3 reflecting limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No vendor advisory states that no action is required or that the vulnerability is already mitigated without patching.