This vulnerability affects Oracle E-Business Intelligence component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized data modifications (update, insert, delete) and unauthorized read access to some data. Exploitation requires user interaction from a third party. The vulnerability impacts confidentiality and integrity but not availability, with a CVSS 3.1 score of 6.1. The vendor advisory linked does not explicitly confirm a patch or remediation level for this vulnerability, though Oracle's July 2026 Critical Patch Update includes many patches and recommends applying them promptly. No known exploits in the wild have been reported.

Successful exploitation can result in unauthorized modification (update, insert, delete) and unauthorized reading of some Oracle E-Business Intelligence accessible data. This compromises data confidentiality and integrity within the affected product. The vulnerability requires user interaction, limiting automated exploitation. There is no indication of impact on availability. The scope of impact may extend beyond Oracle E-Business Intelligence to additional Oracle products due to scope change.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends customers remain on actively-supported versions and apply security patches without delay. Since no explicit patch or temporary fix is stated for this vulnerability, monitoring the vendor advisory for updates is critical. No vendor advisory states that no action is required or that the issue is already mitigated.