This vulnerability affects Oracle Price Protection component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no user interaction required and low attack complexity. The vulnerability is classified under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a patch for this vulnerability, and no patch links are provided.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Price Protection. This compromises confidentiality and integrity of sensitive business data. Availability is not impacted. The vulnerability can be exploited remotely over the network with low privileges and no user interaction, increasing risk.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Price Protection interfaces to trusted users only.