This vulnerability affects Oracle Compensation Workbench, a component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized access to critical data and partial unauthorized modification capabilities. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm the availability of a patch for this specific vulnerability or product version. Therefore, patch status is not yet confirmed and should be verified with Oracle's official advisory.

Successful exploitation can lead to unauthorized access to critical data within Oracle Compensation Workbench and unauthorized update, insert, or delete operations on some accessible data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on system availability. The vulnerability can be exploited remotely over HTTP by an attacker with low privileges, increasing the risk of compromise in exposed environments.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Compensation Workbench interfaces to trusted users only and monitor for unusual activity related to this component.