This vulnerability affects Oracle E-Business Intelligence component 'Definition' in versions 12.2.3 to 12.2.15. It permits a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized modification of accessible data (update, insert, delete). Successful exploitation requires user interaction from a third party, making it difficult to exploit. The CVSS 3.1 base score is 2.0, reflecting low impact primarily on integrity. No official remediation level or patch is explicitly stated in the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory references multiple patches across products without explicitly confirming a fix for this CVE. The advisory strongly recommends applying available patches promptly.

The vulnerability allows unauthorized modification (update, insert, delete) of some data accessible via Oracle E-Business Intelligence. There is no impact on confidentiality or availability. Exploitation requires high privileges, network access via HTTP, and user interaction from a third party, limiting the likelihood and scope of exploitation. The overall impact is low severity with integrity impact only.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying all relevant Critical Patch Updates without delay to mitigate known vulnerabilities. Until a specific patch is confirmed, restrict high privileged network access and minimize opportunities for required user interaction to reduce risk.