This vulnerability affects Oracle Bills of Material in Oracle E-Business Suite versions 12.2.13 to 12.2.15. It permits a low-privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts without availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). The Oracle Critical Patch Update advisory for July 2026 references multiple patches but does not explicitly confirm a patch for this specific vulnerability in the provided content. Customers are urged to remain on supported versions and apply patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Bills of Material, compromising confidentiality and integrity of all accessible data. This could allow attackers to manipulate sensitive business data without authorization. There is no impact on availability reported.

The vendor advisory does not explicitly confirm the availability of a patch for this vulnerability. Oracle strongly recommends customers remain on actively-supported versions and apply Critical Patch Updates without delay. Users should monitor Oracle's official security alerts and apply any relevant patches as soon as they become available. Patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.