This vulnerability affects Oracle SDP Number Portability within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to gain unauthorized access that can lead to creation, deletion, or modification of critical data. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts and no impact on availability. The vulnerability is publicly disclosed and listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches for multiple Oracle products. However, the advisory does not explicitly confirm the availability of a patch for this specific vulnerability, so patch status remains unconfirmed.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle SDP Number Portability. Attackers can gain unauthorized access to all data accessible by the product, impacting confidentiality and integrity. There is no reported impact on availability. The vulnerability is easily exploitable by an attacker with low privileges and network access via HTTP.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict network access to Oracle SDP Number Portability interfaces to trusted users only.