This vulnerability in the Oracle E-Business Suite Secure Enterprise Search component (Search Integration Engine) affects supported versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 base score is 5.4, reflecting low complexity and low privileges required, with impacts on confidentiality and integrity but no impact on availability. The vendor advisory references a Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Customers are urged to apply security patches promptly to mitigate risks.

Successful exploitation can lead to unauthorized read access to some data and unauthorized modification (update, insert, delete) of some data within Oracle E-Business Suite Secure Enterprise Search. This compromises data confidentiality and integrity but does not affect system availability. The attack requires network access via HTTP and low privileges, increasing the risk in exposed environments.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability. However, Oracle strongly recommends applying the latest Critical Patch Updates without delay to address this and other vulnerabilities. Customers should verify patch availability in the July 2026 Critical Patch Update documentation and apply relevant patches promptly. No alternative mitigations or 'no action required' statements are provided by the vendor.