This vulnerability affects the Oracle EDI Gateway component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows a high privileged attacker who already has logon access to the infrastructure hosting Oracle EDI Gateway to compromise the product and gain unauthorized read access to a subset of data accessible by the gateway. The CVSS 3.1 base score is 1.9, reflecting a low impact focused on confidentiality with no integrity or availability impact. The attack vector is local with high attack complexity and requires high privileges, with no user interaction needed. The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but references the July 2026 Critical Patch Update advisory, which includes many patches across Oracle products. No known exploits in the wild have been reported.

The impact is limited to unauthorized read access to some Oracle EDI Gateway accessible data. There is no impact on data integrity or system availability. The vulnerability requires high privileges and local access, making exploitation difficult.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Since no explicit patch or temporary fix is stated for this vulnerability, monitoring the vendor advisory for updates is advised.