This vulnerability affects Oracle iSetup, a component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible via Oracle iSetup. The CVSS 3.1 vector indicates network attack vector with high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory from Oracle does not explicitly confirm patch availability or remediation status for this specific vulnerability but references a Critical Patch Update advisory that includes multiple patches across Oracle products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible through Oracle iSetup. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability requires network access via HTTP and is difficult to exploit, requiring low privileges but high attack complexity.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. Until a specific patch is confirmed, monitor Oracle advisories for updates and apply any relevant patches as soon as they become available.