This vulnerability affects Oracle Scripting in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise Oracle Scripting, resulting in unauthorized read and modification (update, insert, delete) of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts without availability impact. The vendor advisory references a large Critical Patch Update released in July 2026 but does not explicitly confirm a patch for this vulnerability in the provided text. No known exploits in the wild are reported.

Successful exploitation allows unauthorized read access to some data and unauthorized update, insert, or delete access to some Oracle Scripting accessible data. This compromises confidentiality and integrity of affected data but does not affect system availability. The attacker requires network access and low privileges but no user interaction is needed.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. No explicit patch or workaround is stated in the provided advisory content for this specific vulnerability. Until a patch is confirmed and applied, restrict network access to Oracle Scripting interfaces to trusted users only.