This vulnerability affects Oracle Telecommunications Billing Integrator within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is exploitable remotely without authentication but requires user interaction. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high severity, with an impact primarily on data integrity. The scope of the vulnerability extends beyond the initial product, potentially affecting other Oracle products. The vulnerability is identified as CWE-284 (Improper Access Control).

An attacker can remotely exploit this vulnerability without authentication but requires a user to interact (UI:R). The attack can lead to unauthorized modification of critical data, affecting the integrity of Oracle Telecommunications Billing Integrator data and potentially other Oracle products due to scope change. There is no impact on confidentiality or availability reported.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the relevant security patches promptly to affected versions 12.2.3 through 12.2.15 of Oracle Telecommunications Billing Integrator. No indication from the vendor advisory suggests that no action is required or that the issue is already mitigated without patching. Therefore, timely patching is the recommended mitigation.