This vulnerability affects Oracle Transportation Execution component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system, potentially leading to complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references the July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this vulnerability. The vulnerability is associated with CWE-306 (Missing Authentication for Critical Function), CWE-287 (Improper Authentication), and CWE-269 (Improper Privilege Management).

Successful exploitation can result in complete compromise of Oracle Transportation Execution, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially disrupting business operations and exposing sensitive data.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Transportation Execution instances and monitor for suspicious activity related to this product.