This vulnerability affects Oracle Installed Base in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the system by unauthorized modification (update, insert, delete) of some accessible data, unauthorized reading of a subset of accessible data, and the ability to cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation can lead to unauthorized data modification and reading of some data within Oracle Installed Base, as well as partial denial of service conditions. This impacts confidentiality, integrity, and availability of the affected system, but the scope is limited to accessible data subsets and partial service disruption.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to affected versions 12.2.3 through 12.2.15 of Oracle Installed Base. Oracle recommends remaining on actively supported versions and applying patches without delay to prevent exploitation. Patch availability details are provided in the Oracle advisory linked in the source data.