This vulnerability in Oracle E-Business Suite Secure Enterprise Search (component: Search Integration Engine) affects version 12.2.3. It is easily exploitable by a low privileged attacker with network access via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all accessible data within the Secure Enterprise Search component. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vendor advisory does not explicitly confirm a patch or remediation level but strongly recommends applying security patches without delay as part of the July 2026 Critical Patch Update.

The vulnerability allows unauthorized access leading to creation, deletion, or modification of critical data within Oracle E-Business Suite Secure Enterprise Search. This compromises confidentiality and integrity of the data accessible through this component. There is no impact on availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

The vendor advisory (Oracle July 2026 Critical Patch Update) does not explicitly state a patch or remediation level for this specific vulnerability. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches promptly. Users of Oracle E-Business Suite Secure Enterprise Search version 12.2.3 should monitor the Oracle Critical Patch Update advisory and apply any relevant patches as soon as they become available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.