This vulnerability affects Oracle E-Business Intelligence component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is difficult to exploit and requires a high privileged attacker with network access via HTTP. The impact includes unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all data accessible by the product. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The Oracle Critical Patch Update Advisory for July 2026 references this vulnerability but does not explicitly confirm a patch or remediation level for it. Oracle advises customers to remain on supported versions and apply security patches without delay.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle E-Business Intelligence, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not affect availability. The vulnerability requires a high privileged attacker with network access, making exploitation difficult.

The vendor advisory does not explicitly state a patch or remediation level for this specific vulnerability. Oracle recommends that customers remain on actively supported versions and apply Critical Patch Updates promptly to mitigate vulnerabilities. Users should monitor Oracle's official security alerts and apply any relevant patches as soon as they become available. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.