This vulnerability exists in the Oracle Applications Framework component of Oracle E-Business Suite, specifically in Web Utilities. It is exploitable by an attacker with high privileges and network access over HTTP, enabling compromise of the framework. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical impact across confidentiality, integrity, and availability. The scope of impact extends beyond the framework to other Oracle products. The affected versions explicitly include 12.2.8, with the description indicating versions 12.2.8 through 12.2.15 are vulnerable. The vendor advisory references the July 2026 Critical Patch Update, which contains numerous patches but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to complete takeover of Oracle Applications Framework, impacting confidentiality, integrity, and availability of the affected system. The vulnerability's scope change means additional Oracle products may be affected indirectly. The CVSS vector indicates network attack vector, low attack complexity, required high privileges, no user interaction, and scope change with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until official patches or mitigations are confirmed, restrict network access to Oracle Applications Framework components and monitor for suspicious activity from high privileged users with HTTP access.