This vulnerability affects Oracle Advanced Inbound Telephony component of Oracle E-Business Suite, specifically version 12.2.3. It permits a low privileged attacker with network access over HTTP to compromise the product by gaining unauthorized ability to read and modify some accessible data and to cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. The vendor advisory references Oracle's Critical Patch Update July 2026 but does not explicitly confirm a patch for this specific vulnerability within the advisory content provided. Customers are urged to apply Oracle's security patches without delay to mitigate known vulnerabilities.

Successful exploitation can lead to unauthorized read access to some data, unauthorized update, insert, or delete access to some data, and the ability to cause a partial denial of service in Oracle Advanced Inbound Telephony. This impacts confidentiality, integrity, and availability of the affected system to a limited extent as indicated by the CVSS score of 6.3.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying the latest Critical Patch Updates promptly to address this and other vulnerabilities. No specific temporary mitigations or workarounds are provided in the advisory content.