This vulnerability affects Oracle Advanced Benefits component Self Service Benefits in Oracle E-Business Suite versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized ability to read, update, insert, or delete some accessible data and cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to unauthorized read access to some data, unauthorized modification (update, insert, delete) of accessible data, and partial denial of service of Oracle Advanced Benefits. This compromises confidentiality, integrity, and availability of the affected system to a limited extent.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Advanced Benefits and monitor for suspicious activity related to unauthorized data access or modification.