This vulnerability affects the Definition component of Oracle E-Business Intelligence within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It requires a high-privileged attacker with network access over HTTP and necessitates user interaction from a third party. Successful exploitation can lead to unauthorized modification of some accessible data (update, insert, delete). The CVSS 3.1 base score is 2.0, reflecting low severity with integrity impact only. No official patch or remediation level is explicitly stated in the vendor advisory. The vendor advisory references the July 2026 Critical Patch Update but does not specifically confirm a patch for this vulnerability. No known exploits in the wild have been reported.

The vulnerability allows unauthorized modification (update, insert, delete) of certain accessible data within Oracle E-Business Intelligence. It does not impact confidentiality or availability. Exploitation is difficult, requiring high privileges, network access via HTTP, and human interaction from a user other than the attacker. The overall impact is limited to integrity with low severity.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly for all supported versions. Until a patch is confirmed and applied, restrict network access to Oracle E-Business Intelligence and limit high-privileged user exposure where possible.