This vulnerability exists in the DB Privileges component of Oracle Application Object Library within Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the Oracle Application Object Library, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory references the July 2026 Critical Patch Update containing multiple patches but does not explicitly confirm a patch for this specific CVE. Oracle emphasizes the importance of applying available patches without delay to prevent exploitation.

Successful exploitation can lead to complete compromise of the Oracle Application Object Library, impacting confidentiality, integrity, and availability of the affected system. This could allow an attacker to take over the component, potentially leading to unauthorized access and control within Oracle E-Business Suite environments.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability. Oracle recommends that customers apply the July 2026 Critical Patch Update and remain on actively supported versions to mitigate this and other vulnerabilities. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.