This vulnerability affects Oracle iSupport versions 12.2.3 to 12.2.15 and involves a security weakness in the Internal Operations component of the Oracle E-Business Suite. It requires a high privileged attacker with network access over HTTP to exploit. Successful exploitation can lead to complete compromise of Oracle iSupport, impacting confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and unchanged scope. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state if a patch is available for it. The advisory emphasizes the importance of applying patches promptly but does not provide specific remediation details for this CVE.

If exploited, this vulnerability allows a high privileged attacker with network access to take over Oracle iSupport, compromising confidentiality, integrity, and availability of the system. This could lead to unauthorized access and control over Oracle iSupport functionalities. However, exploitation is difficult due to the high privileges required and attack complexity. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly and remaining on actively supported versions. Since no explicit patch or workaround is stated for this vulnerability in the advisory, monitor Oracle's updates for any forthcoming fixes.