This vulnerability exists in the Internal Operations component of Oracle Advanced Planning Command Center within Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. It is exploitable by a high privileged attacker over the network via HTTP with low attack complexity and no user interaction required. Successful exploitation can lead to unauthorized access to critical data and partial unauthorized modification (insert, update, delete) of accessible data. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond the initially affected component. The CVSS vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low complexity, high privileges required, no user interaction, changed scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific CVE.

Exploitation of this vulnerability can result in unauthorized access to critical data within Oracle Advanced Planning Command Center and unauthorized modification (insert, update, delete) of some accessible data. The confidentiality impact is high, and integrity impact is low. There is no impact on availability. The vulnerability requires a high privileged attacker with network access via HTTP. The scope change indicates potential impact on additional Oracle products beyond the initially affected component.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Advanced Planning Command Center to trusted users and monitor for suspicious activity consistent with high privileged access attempts.