This vulnerability affects Oracle Public Sector Financials, a component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It involves an internal operations flaw that can be exploited remotely over HTTP by an attacker with low privileges. Successful exploitation results in unauthorized read access to some data within the affected product. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact only.

An attacker with low privileges and network access via HTTP can read some data they should not have access to within Oracle Public Sector Financials. There is no impact on data integrity or system availability. The confidentiality impact is limited to a subset of accessible data, and the overall severity is low.

The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly to mitigate known vulnerabilities. Since this is not a cloud service, customers must apply patches themselves once available.