This vulnerability exists in the Internal Operations component of Oracle Quality within Oracle E-Business Suite. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in complete takeover. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.3 through 12.2.15. The vendor advisory is a general Critical Patch Update notice listing many products but does not explicitly confirm a patch for Oracle Quality or this CVE, and remediation level is not stated.

Successful exploitation can lead to full compromise of Oracle Quality, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the Oracle Quality application, potentially leading to unauthorized data access, modification, or disruption of service.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Quality HTTP interfaces to trusted users only and monitor for suspicious activity related to Oracle Quality.