This vulnerability affects Oracle Learning Management component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, contingent on user interaction from a third party. The attack can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Learning Management. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vulnerability is associated with CWE-284 (Improper Access Control) and CWE-601 (URL Redirection to Untrusted Site). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a fix for this vulnerability. Patch status is therefore not yet confirmed and should be verified against Oracle's official advisory.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full unauthorized access to all data accessible by Oracle Learning Management. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability requires user interaction from a person other than the attacker, which may limit exploitation scenarios.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit network exposure of Oracle Learning Management and educate users about the risks of interacting with untrusted content to reduce the likelihood of successful exploitation.