This vulnerability affects Oracle Communications Pricing Design Center on-premise deployments in specified versions. It allows an attacker with low privileges and logon access to the underlying infrastructure to compromise the product, resulting in unauthorized access to critical data and limited unauthorized data modification (insert, update, delete). The CVSS vector indicates the attack requires local access (AV:L), low complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and has a scope change (S:C) with high confidentiality impact (C:H), low integrity impact (I:L), and no availability impact (A:N). The vulnerability may also affect other Oracle Communications products due to scope change. The vendor advisory does not explicitly confirm availability of a patch or fix for this specific vulnerability but references the July 2026 Critical Patch Update containing many fixes. No known exploits have been reported in the wild.

Successful exploitation can lead to unauthorized access to all data accessible by Oracle Communications Pricing Design Center and unauthorized modification (insert, update, delete) of some data. This compromises confidentiality and integrity of critical data within the affected product. The vulnerability's scope change means other Oracle Communications products may also be impacted indirectly. There is no reported impact on availability.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a specific patch is confirmed, restrict access to the infrastructure hosting Oracle Communications Pricing Design Center to trusted users only and monitor for suspicious activity. No vendor advisory states that no action is required or that the issue is already mitigated.