This vulnerability affects Oracle Citizen Interaction Center component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an attacker with high privileges and network access over HTTP to compromise the system, resulting in unauthorized access to critical data including the ability to create, delete, or modify such data. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability. Customers are advised to review the advisory and apply patches promptly if available.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Citizen Interaction Center, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity of the data but does not impact system availability. The vulnerability requires a high privileged attacker with network access via HTTP, limiting the attack surface to privileged users with network connectivity.

Patch status is not yet confirmed — check the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. No vendor advisory states that no action is required or that the vulnerability is already mitigated. Therefore, organizations should monitor Oracle's patch releases and apply relevant updates promptly once available.