This vulnerability affects Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is an easily exploitable flaw that allows an attacker with low privileges and network access via HTTP to compromise the Oracle Applications DBA component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is associated with CWE-306 (Missing Authentication for Critical Function), CWE-287 (Improper Authentication), and CWE-269 (Improper Privilege Management). Oracle's July 2026 Critical Patch Update advisory includes numerous patches but does not explicitly confirm patch availability for this specific CVE in the provided content. No known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of Oracle Applications DBA, allowing an attacker to gain control over the affected component. This impacts confidentiality, integrity, and availability of the system. The vulnerability requires only low privileges and network access via HTTP, making it relatively easy to exploit if unpatched.

Oracle's July 2026 Critical Patch Update advisory strongly recommends applying the latest security patches promptly to mitigate vulnerabilities including this one. Although no explicit patch or remediation level is stated in the provided data, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. There are no vendor statements indicating that no action is required or that the vulnerability is already mitigated. Therefore, applying the relevant patches as soon as possible is advised.