This vulnerability affects Oracle Telecommunications Billing Integrator component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within the product, impacting confidentiality and integrity. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references multiple products and vulnerabilities but does not explicitly confirm patch availability or remediation status for this specific vulnerability. No known exploits in the wild have been reported as of the advisory date.

The vulnerability allows unauthorized access to critical data in Oracle Telecommunications Billing Integrator, including the ability to create, delete, or modify data. This compromises the confidentiality and integrity of the data managed by the product. There is no reported impact on availability. The high CVSS score (8.1) reflects the significant risk posed by this vulnerability if exploited.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple security vulnerabilities across its product portfolio. Although the advisory does not explicitly confirm a patch for Oracle Telecommunications Billing Integrator 12.2.3-12.2.15, customers are strongly recommended to review the July 2026 Critical Patch Update documentation and apply all relevant patches promptly. Staying on actively supported versions and applying Oracle patches without delay is the primary mitigation strategy. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, customers should verify patch availability directly from Oracle's official resources.