This vulnerability affects Oracle Price Protection component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the product by unauthorized data manipulation (update, insert, delete) and unauthorized read access to some data. Additionally, the attacker can cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly recommends applying security patches without delay.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some Oracle Price Protection data. It can also cause a partial denial of service affecting availability. The impact is rated as medium severity with limited confidentiality, integrity, and availability impacts.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability. Oracle recommends customers remain on actively-supported versions and apply Critical Patch Updates promptly. Users of Oracle Price Protection versions 12.2.3 through 12.2.15 should monitor Oracle's security alerts and apply relevant patches as soon as they become available. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.