This vulnerability in Oracle Inventory Management (Oracle E-Business Suite component Core Receiving) affects supported versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Inventory Management. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. No known exploits in the wild have been reported. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability at this time.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle Inventory Management. This compromises confidentiality and integrity of the affected system's data. Availability impact is not indicated. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly for all supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Inventory Management interfaces and monitor for suspicious activity consistent with unauthorized data access or modification attempts.