This vulnerability affects Oracle iSupport, a component of Oracle E-Business Suite Internal Operations, specifically versions 12.2.3 through 12.2.15. It permits an unauthenticated attacker with network access via HTTP to compromise the system, contingent on human interaction from a user other than the attacker. The vulnerability results in unauthorized modification of critical data, with a scope change potentially affecting other Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N) reflects network attack vector, low attack complexity, no privileges required, required user interaction, scope change, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability but references the July 2026 Critical Patch Update containing numerous patches. Users are advised to consult the advisory for patch details.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle iSupport. The vulnerability affects data integrity but does not impact confidentiality or availability. Due to scope change, other Oracle products accessible via Oracle iSupport may also be impacted. The attack requires network access and user interaction from a third party, increasing the attack complexity but still allowing unauthenticated attackers to initiate the attack.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions to mitigate this and other vulnerabilities. No specific temporary mitigations or workarounds are provided in the advisory.