This vulnerability affects Oracle Risk Management component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, leading to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Risk Management. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vulnerability is classified under CWE-284 (Improper Access Control). There is no explicit patch or remediation level stated in the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory references security patches for multiple products and recommends applying patches promptly. The advisory URL is https://www.oracle.com/security-alerts/cpujul2026.html.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle Risk Management, or unauthorized access to all accessible data in the product. This compromises confidentiality and integrity of sensitive business data managed by Oracle Risk Management. Availability is not impacted. The vulnerability can be exploited remotely over the network with low privileges and no user interaction required.

The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references the July 2026 Critical Patch Update containing multiple security patches. Oracle strongly recommends customers remain on actively-supported versions and apply security patches without delay. Users of Oracle Risk Management versions 12.2.3 through 12.2.15 should consult the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and apply relevant patches promptly to remediate this vulnerability.