This vulnerability affects Oracle Project Intelligence within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the system, leading to a potential full takeover of Oracle Project Intelligence. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. Oracle has acknowledged this issue in its July 2026 Critical Patch Update advisory but has not explicitly stated patch availability or remediation level in the provided content.

Successful exploitation can lead to complete compromise of Oracle Project Intelligence, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized data access, modification, or service disruption.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory and strongly recommends applying security patches without delay. Users should review the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Patch status is not yet confirmed explicitly in the advisory excerpt; therefore, users must verify current remediation guidance from Oracle. Until patched, restrict network access to Oracle Project Intelligence and monitor for suspicious activity consistent with this vulnerability.