This vulnerability affects Oracle Mobile Application Server within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is an easily exploitable flaw that permits a high privileged attacker with network access over HTTP to compromise the server. The CVSS 3.1 base score is 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. The vendor advisory references a Critical Patch Update released in July 2026 covering multiple vulnerabilities but does not explicitly confirm a patch for this specific CVE. Oracle strongly advises customers to remain on supported versions and apply patches promptly. No known exploits in the wild are reported at this time.

Successful exploitation can lead to complete compromise of Oracle Mobile Application Server, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the server and potentially disrupt services or access sensitive data.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. Until a specific patch is confirmed, monitor Oracle advisories for updates and apply any relevant patches as soon as they become available.