This vulnerability affects Oracle Property Manager, a component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It allows a high privileged attacker who already has logon access to the infrastructure where Oracle Property Manager runs to compromise the application and gain unauthorized read access to a subset of accessible data. The vulnerability is rated low severity (CVSS 3.1 score 1.9) due to the difficulty of exploitation, requirement for high privileges, and limited confidentiality impact. There is no indication of impact on integrity or availability. No official patch or remediation level is stated in the advisory, and no known exploits are reported in the wild. Oracle’s Critical Patch Update advisory for July 2026 references this vulnerability but does not explicitly confirm patch availability for Oracle Property Manager. Customers are advised to review the advisory and apply updates as recommended.

Successful exploitation results in unauthorized read access to a subset of data accessible by Oracle Property Manager. The vulnerability does not affect data integrity or availability. Exploitation requires high privileges and local access to the infrastructure, making it difficult to exploit. The overall impact is limited to confidentiality with a low severity rating.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively-supported versions. Since no explicit patch or workaround is detailed for this vulnerability, monitoring Oracle advisories for updates is advised.