This vulnerability exists in the Internal Operations component of Oracle Advanced Planning Command Center within Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.15. It is easily exploitable by an attacker with high privileges and network access over HTTP. Successful exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high severity with network attack vector, low attack complexity, required high privileges, no user interaction, and scope change. Confidentiality impact is high, integrity impact is low, and availability impact is none. The vulnerability may also affect additional Oracle products due to scope change. Oracle's Critical Patch Update advisory for July 2026 references multiple patches but does not explicitly confirm a patch for this vulnerability at the time of publication.

Successful exploitation allows a high privileged attacker with network access to gain unauthorized access to critical data within Oracle Advanced Planning Command Center and perform unauthorized modifications (update, insert, delete) on some accessible data. The confidentiality impact is high, integrity impact is low, and availability is not affected. The vulnerability also has potential to impact additional Oracle products due to scope change.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Advanced Planning Command Center to trusted users and monitor for suspicious activity consistent with high privileged access misuse.