This vulnerability affects Oracle Customers Online component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low-privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no user interaction required. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory references a Critical Patch Update released in July 2026 but does not explicitly confirm a patch for this specific vulnerability in the provided content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible through Oracle Customers Online. This compromises confidentiality and integrity of the affected system's data. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and remaining on actively supported versions. Until an official patch is confirmed, restrict network access to Oracle Customers Online and monitor for unusual activity consistent with unauthorized data manipulation.