This vulnerability affects Oracle Price Protection in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access over HTTP to compromise the product, resulting in unauthorized access to sensitive data. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vendor advisory references a Critical Patch Update containing numerous patches but does not explicitly confirm a fix for this vulnerability. Patch status is therefore not confirmed and should be verified by consulting the vendor advisory directly.

Successful exploitation can lead to unauthorized access to critical data within Oracle Price Protection, compromising confidentiality. There is no reported impact on data integrity or availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Price Protection interfaces where possible to limit exposure.