This vulnerability affects Oracle Property Manager component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system by leveraging required user interaction. Successful exploitation can lead to unauthorized modification (update, insert, delete) and limited unauthorized read access to Oracle Property Manager data. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, required user interaction, scope change, and partial confidentiality and integrity impacts. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes multiple patches across Oracle products, but no explicit patch or remediation status for this specific vulnerability is stated in the advisory content provided.

Successful exploitation can result in unauthorized update, insertion, or deletion of some Oracle Property Manager accessible data, as well as unauthorized read access to a subset of that data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products may also be affected indirectly. The CVSS score of 5.4 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address this and other vulnerabilities. Until a patch is applied, limit network exposure of Oracle Property Manager and ensure users are aware of social engineering risks since exploitation requires user interaction.