This vulnerability affects Oracle Customer Support in Oracle E-Business Suite versions 12.2.3 to 12.2.15, specifically the Update Service Request component. It allows an attacker with low privileges and network access via HTTP to gain unauthorized access that can lead to creation, deletion, or modification of critical data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this specific vulnerability or version. No known exploits in the wild have been reported.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Customer Support, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Customer Support interfaces where possible to limit exposure.