This vulnerability affects Oracle Retail EFTLink (component: Core/Plugin) in versions 21.0.0 through 25.0.0. It is difficult to exploit but allows an unauthenticated attacker with network access over HTTPS to compromise the system. The impact includes unauthorized creation, deletion, or modification of critical data or all accessible data in Oracle Retail EFTLink, as well as unauthorized access to such data. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. No known exploits in the wild have been reported. Oracle has published a Critical Patch Update advisory including this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue in the provided advisory content.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Retail EFTLink, as well as unauthorized access to such data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. No specific temporary mitigations or workarounds are provided in the advisory content.