This vulnerability affects Oracle Service Fulfillment Manager component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It enables a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 score of 8.7, indicating high impact on confidentiality and integrity. The attack scope may extend beyond the immediate product to other Oracle products. The vendor advisory does not explicitly confirm the availability of a patch or fix at this time.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Service Fulfillment Manager. Confidentiality and integrity of all accessible data can be fully compromised. The vulnerability requires high privileges and network access via HTTP. There is no indication of impact on availability. The scope of impact may extend to additional Oracle products beyond the immediate component.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively-supported versions. Until a patch is confirmed, restrict network access to Oracle Service Fulfillment Manager instances to trusted users and monitor for suspicious activity consistent with high privileged access abuse.