This vulnerability affects Oracle Compensation Workbench within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low-privileged attacker with network access over HTTP to compromise the application, resulting in unauthorized access to critical data and partial unauthorized modification capabilities (update, insert, delete) on accessible data. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, requiring low privileges, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory linked is a general Critical Patch Update advisory without explicit mention of a patch for this vulnerability, and no remediation level is stated.

Successful exploitation can lead to unauthorized disclosure of critical data and unauthorized modification (update, insert, delete) of some data within Oracle Compensation Workbench. This compromises confidentiality and integrity of the affected system's data. Availability is not impacted. The attacker requires network access and low privileges but no user interaction is needed.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Compensation Workbench and monitor for unusual activity consistent with unauthorized access attempts.