This vulnerability affects Oracle Public Sector Financials component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to gain unauthorized update, insert, delete, and read access to some accessible data within the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impacts to confidentiality and integrity but not availability. Oracle has published this vulnerability in their July 2026 Critical Patch Update advisory, which includes patches addressing this and other vulnerabilities.

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data in Oracle Public Sector Financials, potentially leading to data confidentiality and integrity breaches. There is no impact on system availability. The vulnerability can be exploited remotely over the network with low privileges and no user interaction required.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Customers using affected versions should apply the relevant security patches promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory linked in the report.