This vulnerability affects Oracle Demand Signal Repository within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is an easily exploitable SQL-based vulnerability that allows a low privileged attacker with network access to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the Oracle Demand Signal Repository. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions numerous security patches but does not explicitly confirm a patch for this specific vulnerability. No known exploits in the wild have been reported.

The vulnerability allows unauthorized access leading to creation, deletion, or modification of critical data within Oracle Demand Signal Repository. This compromises data confidentiality and integrity, potentially exposing sensitive business information or disrupting data accuracy. Availability is not impacted according to the CVSS vector. The attack requires network access and low privileges, increasing the risk of exploitation in networked environments.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Until a confirmed patch is applied, restrict network access to the Oracle Demand Signal Repository and monitor for unusual SQL activity where possible.