This vulnerability affects Oracle Contracts Integration component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Contracts Integration. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is publicly disclosed and listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches across Oracle products. However, the advisory does not explicitly confirm the availability of a patch for this specific vulnerability or version.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Contracts Integration, or unauthorized access to all data accessible by this product. This compromises data confidentiality and integrity but does not affect system availability. The vulnerability is exploitable remotely over the network via HTTP by an attacker with low privileges, increasing the risk of compromise.

Oracle has released a Critical Patch Update advisory in July 2026 addressing multiple security vulnerabilities. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Since the advisory is the authoritative source and does not explicitly confirm patch availability for this specific vulnerability, users should verify patch status and remediation instructions directly from Oracle. Maintaining up-to-date patches and running supported versions is critical. No vendor advisory states that no action is required or that the vulnerability is already mitigated.