This vulnerability affects Oracle Application Object Library component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. An unauthenticated attacker with network access over HTTP can exploit this flaw to compromise the application, resulting in unauthorized access to sensitive data. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the attack can be performed remotely with low complexity, no privileges, and no user interaction, impacting confidentiality but not integrity or availability. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). The Oracle Critical Patch Update Advisory for July 2026 references this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue.

Successful exploitation can lead to unauthorized disclosure of critical data accessible through Oracle Application Object Library. There is no indication of impact on data integrity or availability. The vulnerability enables attackers to bypass authentication and access sensitive information remotely via HTTP.

Patch status is not yet confirmed — check the Oracle Critical Patch Update Advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Application Object Library interfaces to trusted users only.