This vulnerability affects the Oracle Telecommunications Billing Integrator component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is an easily exploitable vulnerability that requires only low privileges and network access via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state patch availability or remediation details for it.

The vulnerability allows attackers with low privileges and network access to gain unauthorized creation, deletion, or modification capabilities over critical data within Oracle Telecommunications Billing Integrator. This compromises the confidentiality and integrity of the data managed by the product. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or remediation for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until official patches are applied, organizations should restrict network access to the affected product to trusted users and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.