This vulnerability affects Oracle SDP Number Portability component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable by a high privileged attacker with logon access to the infrastructure where the product executes. The vulnerability allows unauthorized creation, deletion, or modification of critical data, unauthorized read access to a subset of data, and partial denial of service. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L) reflects local attack vector, low attack complexity, high privileges required, no user interaction, scope change, low confidentiality impact, high integrity impact, and low availability impact. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability but does not explicitly list a direct patch link for this specific CVE in the provided data.

An attacker with high privileges and logon access to the affected infrastructure can compromise Oracle SDP Number Portability, leading to unauthorized creation, deletion, or modification of critical data, unauthorized read access to some data, and partial denial of service. The vulnerability may also affect additional Oracle products due to scope change.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update, which includes numerous security fixes across Oracle products. Customers should remain on actively supported versions and apply security patches without delay. Specific patch availability for this vulnerability should be confirmed via the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No indication was given that no action is required or that the vulnerability is already mitigated without patching.