This vulnerability affects Oracle Price Protection component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch or remediation level for this specific vulnerability but strongly recommends applying available security patches promptly. No exploits in the wild are currently known.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Price Protection. The confidentiality impact is high, but there is no impact on integrity or availability. This could result in sensitive business information exposure.

Oracle's July 2026 Critical Patch Update advisory does not explicitly state a patch or remediation level for this vulnerability. Customers are strongly advised to remain on actively supported versions and apply Oracle Critical Patch Updates without delay to mitigate this and other vulnerabilities. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.