This vulnerability affects Oracle Cost Management (component: Cost Planning) in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It requires a high privileged attacker with network access via HTTP and no user interaction. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L, indicating network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references the July 2026 Critical Patch Update containing numerous patches. Customers are strongly advised to apply Oracle Critical Patch Updates promptly.

An attacker with high privileges and network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data within Oracle Cost Management. They can also access all data accessible by Oracle Cost Management without authorization and cause a partial denial of service affecting availability. This compromises confidentiality, integrity, and availability of the affected system.

The vendor advisory references the Oracle July 2026 Critical Patch Update, which includes numerous security patches. While no explicit patch is confirmed for this specific vulnerability in the advisory content, Oracle strongly recommends applying all relevant Critical Patch Updates without delay to mitigate such vulnerabilities. Customers should verify patch availability and apply updates for Oracle Cost Management versions 12.2.3 through 12.2.15 as soon as possible. Patch status is not yet confirmed for this specific CVE; check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.