This vulnerability affects Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable by a high privileged attacker with network access over HTTP, enabling compromise and potential takeover of the Oracle Applications DBA environment. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory from Oracle's July 2026 Critical Patch Update mentions a large set of patches but does not explicitly confirm a patch or remediation status for this vulnerability. Customers are urged to remain on supported versions and apply patches without delay.

Successful exploitation can lead to complete compromise of Oracle Applications DBA, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected Oracle Applications DBA environment, potentially leading to unauthorized access and control over critical business operations managed by Oracle E-Business Suite.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle recommends applying all relevant security patches promptly and remaining on actively-supported versions to mitigate exploitation risks.