This vulnerability affects Oracle Document Management and Collaboration versions 12.2.3 through 12.2.15, specifically the Attachments component. It enables a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical or all accessible data within the product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is classified under CWE-284 (Improper Access Control). The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle Document Management and Collaboration. This results in a high impact on confidentiality and integrity of the data. There is no impact on availability reported. The vulnerability can be exploited remotely over the network with low privileges and no user interaction required.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected Oracle Document Management and Collaboration service to trusted users only.