This vulnerability affects Oracle Property Manager versions 12.2.3 through 12.2.15 and allows a high privileged attacker with network access via HTTP to compromise the system. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update, which contains 245 security patches across multiple Oracle products. Oracle strongly recommends applying these patches without delay. Workarounds include blocking network protocols required by the attack and removing unnecessary privileges from users, though these may affect application functionality.

Successful exploitation can lead to complete compromise of Oracle Property Manager, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the application and potentially disrupt business operations or access sensitive data.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required by the attack and removing unnecessary privileges from users, understanding that these measures may disrupt normal application functionality. Patch status is confirmed by the vendor advisory. No indication that the vulnerability is already mitigated without patching.