This vulnerability affects Oracle Citizen Interaction Center within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows a high privileged attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data, or unauthorized access to all data accessible by the product. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory linked is a general Critical Patch Update advisory for July 2026, which includes many patches but does not explicitly confirm a patch for this specific vulnerability or remediation status. No known exploits in the wild have been reported.

Successful exploitation allows a high privileged attacker with network access to compromise Oracle Citizen Interaction Center, resulting in unauthorized creation, deletion, or modification of critical data, or unauthorized access to all data accessible by the product. This impacts confidentiality and integrity of data but does not affect availability. The vulnerability requires high privileges to exploit and network access via HTTP.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory. Organizations should monitor Oracle's Critical Patch Updates and apply relevant patches promptly once available.