This vulnerability affects Oracle iSupplier Portal, a component of Oracle E-Business Suite (Internal Operations). It allows an unauthenticated attacker with network access via HTTP to compromise the portal by obtaining unauthorized read access to a subset of accessible data. The vulnerability is rated as difficult to exploit and has a CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating a low confidentiality impact without affecting integrity or availability. Affected versions explicitly include 12.2.3 through 12.2.15. No official remediation level or patch information is provided in the vendor advisory, but Oracle strongly recommends applying Critical Patch Updates promptly. The vendor advisory URL is https://www.oracle.com/security-alerts/cpujul2026.html.

Successful exploitation results in unauthorized read access to a subset of data accessible via Oracle iSupplier Portal. There is no impact on data integrity or availability. The vulnerability requires network access via HTTP and is difficult to exploit, limiting the potential impact. No known exploits in the wild have been reported.

Oracle has not explicitly stated a remediation level or patch availability for this specific vulnerability in the provided advisory. However, Oracle recommends that customers remain on actively supported versions and apply Critical Patch Updates without delay. Users of Oracle iSupplier Portal versions 12.2.3 through 12.2.15 should monitor Oracle's Critical Patch Update advisories and apply relevant patches as soon as they become available. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.