This vulnerability affects Oracle Quoting versions 12.2.3 to 12.2.15 within Oracle E-Business Suite. It permits a low privileged attacker with network access over HTTP to compromise Oracle Quoting, potentially resulting in complete takeover of the component. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update notice listing many products and versions but does not explicitly state a patch for Oracle Quoting or provide remediation details for this specific vulnerability.

Successful exploitation can lead to full compromise of Oracle Quoting, affecting confidentiality, integrity, and availability of the component. This could allow an attacker to take over Oracle Quoting operations within the Oracle E-Business Suite environment. The attack requires network access via HTTP and low privileges but is difficult to exploit.

Oracle has published a Critical Patch Update advisory for July 2026 that includes many security patches across products. However, the advisory content provided does not explicitly confirm a patch or remediation for this specific vulnerability in Oracle Quoting. Therefore, patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant patches promptly once available and remaining on actively supported versions.