This vulnerability affects Oracle Cost Management (component: Cost Planning) in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It requires a high privileged attacker with network access via HTTP and is difficult to exploit. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L, indicating network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact. No known exploits in the wild have been reported. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Cost Management, unauthorized access to all accessible data, and the ability to cause a partial denial of service. The confidentiality and integrity impacts are high, while availability impact is low. The vulnerability requires high privileges and network access via HTTP, making exploitation difficult.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and remaining on actively supported versions. Since no explicit patch or workaround is stated for this vulnerability in the advisory, monitor Oracle's updates and apply patches as they become available.