This vulnerability affects Oracle Supply Chain Trading Connector component Collaboration History in Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized ability to update, insert, or delete some accessible data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L with a base score of 6.3. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle advises customers to remain on supported versions and apply security patches without delay.

Successful exploitation can lead to unauthorized modification (update, insert, delete) of some Oracle Supply Chain Trading Connector accessible data, unauthorized read access to a subset of that data, and partial denial of service conditions affecting availability. The confidentiality, integrity, and availability impacts are all low to medium as reflected by the CVSS score of 6.3.

Oracle's July 2026 Critical Patch Update advisory should be consulted for patch availability and installation instructions. Although no explicit patch or remediation level is stated for this vulnerability, Oracle strongly recommends applying all relevant security patches promptly to mitigate exploitation risks. Customers should ensure they are running actively supported versions and apply Critical Patch Updates without delay.