This vulnerability affects Oracle Quality versions 12.2.3 through 12.2.15 within Oracle E-Business Suite. It is exploitable by a high privileged attacker with network access over HTTP, enabling unauthorized access to critical data and the ability to perform unauthorized update, insert, or delete operations on Oracle Quality accessible data. Additionally, it can cause a partial denial of service. The vulnerability has a scope change, meaning it may impact other Oracle products beyond Oracle Quality. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, changed scope, high confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized access to critical data within Oracle Quality, unauthorized modification (update, insert, delete) of some data, and partial denial of service conditions. The scope change indicates that other Oracle products integrated with or dependent on Oracle Quality may also be impacted. The vulnerability compromises confidentiality significantly, with lesser but notable impacts on integrity and availability.

The vendor advisory does not explicitly state the availability of a patch or fix for this specific vulnerability. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly for all supported products. Until a patch is confirmed, restrict network access to Oracle Quality interfaces to trusted users with appropriate privileges.