This vulnerability affects Oracle Price Protection within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker who can log on to the infrastructure where Oracle Price Protection runs to compromise the product. The scope of impact may extend beyond Oracle Price Protection to other products. Exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Price Protection. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact with no availability impact. No known exploits in the wild have been reported. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references the July 2026 Critical Patch Update containing numerous patches. Customers are strongly advised to apply Oracle patches promptly.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle Price Protection, potentially extending impact to additional Oracle products. Confidentiality and integrity of data are highly impacted, but availability is not affected. This could lead to significant data compromise within affected environments.

The vendor advisory references the Oracle July 2026 Critical Patch Update, which includes numerous security patches. However, no explicit patch or remediation level is confirmed for this specific vulnerability in the advisory content provided. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and apply relevant patches without delay. Until patches are applied, restrict logon access to the infrastructure hosting Oracle Price Protection to trusted users only. Monitor Oracle's official advisories for updates on remediation status.