This vulnerability affects Oracle Property Manager versions 12.2.3 through 12.2.15 and allows a high privileged attacker with network access via HTTP to compromise the product. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle has published this issue in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple products. The advisory strongly urges customers to apply patches without delay and consider privilege reduction and network protocol blocking as interim mitigations. Patch availability details are referenced in the vendor advisory but not explicitly listed in the provided data.

Successful exploitation allows a high privileged attacker with network access via HTTP to fully compromise Oracle Property Manager, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected application. The CVSS score of 7.2 reflects a high severity vulnerability with significant potential damage to the system and data.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses this vulnerability among others. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges or access to sensitive packages from users who do not require them. These mitigations may impact application functionality, so they should be tested carefully. Customers should remain on actively supported versions and apply security patches promptly as per Oracle's advisory.