This vulnerability affects Oracle Scripting component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. A high privileged attacker with network access over HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical or all Oracle Scripting accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory references a Critical Patch Update for July 2026 containing numerous security patches but does not explicitly confirm a patch for this specific vulnerability. Patch status is therefore not confirmed and should be verified by consulting the vendor advisory directly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Scripting, as well as unauthorized access to all data accessible by Oracle Scripting. This compromises confidentiality and integrity of the affected data but does not impact availability. The attacker must have high privileges and network access via HTTP to exploit this vulnerability.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Scripting interfaces to trusted users with high privileges only.