This vulnerability affects Oracle iSupplier Portal, a component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It allows an unauthenticated attacker with network access over HTTP to read a subset of data accessible through the portal without authorization. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and only a low confidentiality impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm a patch or remediation level for it. Oracle emphasizes the importance of applying available security patches promptly to mitigate such vulnerabilities.

Successful exploitation results in unauthorized read access to a subset of data accessible via Oracle iSupplier Portal. There is no impact on data integrity or availability. The confidentiality impact is low, and the vulnerability is difficult to exploit. No known exploits are reported in the wild at this time.

Oracle's advisory does not explicitly state a patch or remediation for this specific vulnerability. Customers should review the July 2026 Critical Patch Update advisory and apply all relevant security patches promptly as recommended by Oracle. Maintaining up-to-date software versions within the supported range and following Oracle's patching guidance is the primary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.