This vulnerability in Oracle Quality (component: Internal Operations) of Oracle E-Business Suite affects supported versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise Oracle Quality, potentially resulting in takeover of the product. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is classified as difficult to exploit. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among 1449 security patches across multiple products. The advisory strongly recommends applying patches without delay. No explicit patch version or remediation level is provided in the input, but the advisory URL is authoritative for patch status.

Successful exploitation can lead to complete compromise of Oracle Quality, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over Oracle Quality, potentially leading to unauthorized access, data manipulation, and service disruption. The vulnerability requires network access via HTTP and low privileges, but exploitation complexity is high.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among many others. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Applying the provided patches promptly is the recommended mitigation. No alternative or temporary mitigations are specified. Patch status is confirmed by the vendor advisory as available through the Critical Patch Update.