This vulnerability affects Oracle Order Entry versions 12.2.3 to 12.2.15 within Oracle E-Business Suite. It permits a high privileged attacker who already has logon access to the infrastructure hosting Oracle Order Entry to compromise the application by unauthorized modification (update, insert, delete) of some accessible data and to cause a partial denial of service. The CVSS vector indicates the attack requires local access with low complexity, high privileges, no user interaction, and impacts integrity and availability but not confidentiality. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly encourages applying available patches promptly to mitigate vulnerabilities.

Successful exploitation allows unauthorized modification of Oracle Order Entry accessible data and partial denial of service conditions. The attacker must have high privileges and logon access to the hosting infrastructure, limiting the attack vector to insiders or compromised accounts with elevated rights. Confidentiality is not impacted. The overall severity is low based on CVSS 3.1 score 3.4.

Patch status is not yet confirmed—check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle recommends customers remain on actively supported versions and apply security patches without delay. Since no explicit patch or temporary fix is stated for this vulnerability, monitoring Oracle advisories for updates is advised. Restricting high privileged access to the infrastructure where Oracle Order Entry executes can reduce risk.