This vulnerability affects Oracle Property Manager within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP by an attacker with low privileges and requires user interaction from a third party. The vulnerability allows unauthorized modification (update, insert, delete) and partial unauthorized reading of accessible data within Oracle Property Manager. The scope of impact may extend to other Oracle products due to the interconnected nature of the environment. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and limited confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a fix for this vulnerability in the provided excerpt, and no direct patch links are given.

Successful exploitation can lead to unauthorized update, insertion, or deletion of data within Oracle Property Manager, as well as unauthorized reading of some data. This compromises the confidentiality and integrity of the affected data. The vulnerability requires user interaction and low attacker privileges but can affect multiple products due to scope change. There is no impact on availability reported.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit network exposure of Oracle Property Manager and educate users to be cautious of unsolicited interactions that could trigger exploitation.