This vulnerability affects Oracle Learning Management component Import And Export in Oracle E-Business Suite, specifically version 12.2.3. It allows an attacker with low privileges and network access via HTTP to compromise the system by gaining unauthorized ability to update, insert, or delete certain accessible data, read some data without authorization, and cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized modification (update, insert, delete) of some Oracle Learning Management accessible data, unauthorized reading of a subset of data, and partial denial of service affecting availability. The overall impact is medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS score.

The vendor advisory does not explicitly confirm patch availability or remediation level for this specific vulnerability. Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions to mitigate exploitation risks.