This vulnerability affects the Collaboration History component of Oracle Supply Chain Trading Connector within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is easily exploitable by unauthenticated attackers over HTTP, allowing unauthorized access to critical data and limited unauthorized modification capabilities. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low integrity impact. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but strongly urges customers to apply Critical Patch Updates without delay.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Supply Chain Trading Connector. Additionally, attackers may gain unauthorized ability to update, insert, or delete some of the accessible data. This compromises confidentiality and integrity of the affected system's data, potentially impacting business operations relying on this data.

The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability. Oracle recommends that customers remain on actively supported versions and apply Critical Patch Updates promptly to mitigate this and other vulnerabilities. Users should consult the Oracle Critical Patch Update Advisory for July 2026 for the latest patch availability and installation instructions. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.