This vulnerability affects Oracle Inventory Optimization (component: User Interface) in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to cause a partial denial of service condition. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) reflects that the attack requires high attack complexity, low privileges, no user interaction, and impacts availability only. No confidentiality or integrity impacts are noted. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references the July 2026 Critical Patch Update, which includes numerous patches. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized partial denial of service of Oracle Inventory Optimization, affecting availability. There is no impact on confidentiality or integrity. The attack requires network access and low privileges but has high attack complexity, making exploitation difficult.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations are provided in the advisory.