This vulnerability affects Oracle Property Manager, a component of Oracle E-Business Suite (Internal Operations), in versions 12.2.3 through 12.2.15. It permits an attacker with low privileges and network access via HTTP to compromise the system by unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 base score is 5.4, reflecting low complexity attack vector (network), low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. The vendor advisory is a general Critical Patch Update for July 2026 covering many products but does not explicitly confirm patch availability or remediation details for this vulnerability.

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible by Oracle Property Manager. This compromises data confidentiality and integrity but does not impact system availability. The attacker requires network access and low privileges, increasing the risk of exploitation in network-exposed environments.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate known vulnerabilities. Until a specific patch is confirmed, restrict network access to Oracle Property Manager interfaces to trusted users only and monitor for unusual activity related to data access or modification.