This vulnerability affects Oracle iSupplier Portal within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access over HTTP to compromise the portal by unauthorized reading of a subset of accessible data. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact. There is no official remediation level or patch explicitly stated in the advisory. The vendor advisory references the July 2026 Critical Patch Update but does not specify a direct patch for this vulnerability.

Successful exploitation results in unauthorized read access to some data within Oracle iSupplier Portal, impacting confidentiality. There is no impact on integrity or availability. The vulnerability is difficult to exploit and requires network access via HTTP and low privileges.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly. No specific workaround or temporary fix is provided in the advisory.