This vulnerability affects Oracle E-Business Intelligence component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is exploitable over the network without authentication via HTTP, but requires user interaction from a third party. The vulnerability allows unauthorized modification (update, insert, delete) and limited unauthorized reading of accessible data within Oracle E-Business Intelligence. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch or remediation level for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can result in unauthorized modification (update, insert, delete) of some Oracle E-Business Intelligence accessible data and unauthorized read access to a subset of that data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that the vulnerability may affect additional products beyond Oracle E-Business Intelligence. The CVSS score of 6.1 reflects a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit network exposure of Oracle E-Business Intelligence instances and ensure that users are aware of potential social engineering attempts requiring user interaction.