This vulnerability affects Oracle Scripting in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is difficult to exploit and requires network access via HTTP with low privileges. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to critical or all accessible data, and partial denial of service conditions. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with low availability impact. No specific patch or remediation level is stated in the advisory, but Oracle strongly recommends applying available security patches promptly as part of their Critical Security Patch Update program.

The vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Scripting, unauthorized access to critical or all accessible data, and partial denial of service. This impacts confidentiality, integrity, and availability of the affected system. The attack requires network access and low privileges but is difficult to exploit due to high attack complexity.

Oracle has not explicitly stated a specific patch or remediation level for this vulnerability in the provided advisory. However, Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay, as this vulnerability is included in their August 2026 Critical Security Patch Update. Users should review the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions and apply the relevant patches promptly.