This vulnerability affects Oracle Application Object Library component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit but allows an unauthenticated attacker with network access over HTTP to compromise the application. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible through the Oracle Application Object Library. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

An attacker exploiting this vulnerability can gain unauthorized access to critical data and perform unauthorized creation, deletion, or modification of data within the Oracle Application Object Library. This compromises the confidentiality and integrity of the affected system's data. There is no impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle Critical Patch Update Advisory for July 2026 references this vulnerability but does not explicitly confirm patch availability for Oracle Application Object Library. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updates and patch availability.