This vulnerability affects Oracle In-Memory Cost Management for Discrete Industries, a component of Oracle E-Business Suite (Internal Operations). Versions 12.2.3 through 12.2.15 are impacted. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update references multiple patches but does not explicitly state a fix for this vulnerability, and remediation level is not provided.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle In-Memory Cost Management for Discrete Industries. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely without authentication or user interaction, increasing the risk of data exposure.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant updates promptly. Until a patch is confirmed and applied, restrict network access to the affected product to trusted users only and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.