This vulnerability affects Oracle Contracts Integration component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable by an attacker with low privileges who has network access via HTTP, though it is described as difficult to exploit. Successful exploitation can lead to unauthorized access to critical or all accessible data within the Oracle Contracts Integration environment. The CVSS 3.1 vector indicates network attack vector (AV:N), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N). The vendor advisory linked is a general Critical Patch Update advisory for July 2026 but does not explicitly confirm patch availability or remediation details for this specific vulnerability.

The vulnerability allows unauthorized access to critical or all accessible data in Oracle Contracts Integration, impacting confidentiality. There is no reported impact on integrity or availability. The attack requires network access via HTTP and low privileges but is considered difficult to exploit. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Contracts Integration interfaces where possible and monitor for unusual access patterns consistent with attempts to exploit this vulnerability.