This vulnerability affects the Collaboration History component of Oracle Supply Chain Trading Connector within Oracle E-Business Suite. It is exploitable remotely without authentication via HTTP, enabling attackers to access sensitive data and modify some data without authorization. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and low integrity impacts. The affected versions explicitly include 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update advisory references this vulnerability and provides patches as part of a cumulative update. No known exploits in the wild have been reported at this time.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Oracle Supply Chain Trading Connector, as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise.

Oracle has released security patches addressing this vulnerability as part of the July 2026 Critical Patch Update. Customers should apply these patches promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security updates without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified in the advisory.