This vulnerability affects Oracle Scripting component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a high privileged attacker with network access via HTTP to perform unauthorized actions such as creation, deletion, or modification of critical data accessible through Oracle Scripting. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch for this specific vulnerability but strongly urges customers to apply available patches promptly. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Scripting, compromising confidentiality and integrity of all data accessible through this component. There is no impact on availability. The attacker must have high privileges and network access via HTTP to exploit this vulnerability.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches without delay to mitigate this and other vulnerabilities. No specific temporary mitigations or workarounds are provided in the advisory.