This vulnerability in Oracle Applications Manager (component: Oracle Diagnostics Interfaces) allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on some accessible data. The affected versions are 12.2.3 through 12.2.15. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, with low confidentiality and integrity impacts and no availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch for this specific CVE but strongly recommends applying available patches promptly. No known exploits have been reported in the wild.

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle Applications Manager, potentially compromising confidentiality and integrity of that data. There is no impact on availability. The vulnerability can be exploited remotely without authentication, increasing risk exposure.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to mitigate vulnerabilities. However, no explicit patch or remediation level is confirmed for this CVE in the advisory. Organizations should monitor Oracle's security advisories for patch availability and apply updates as soon as they are released. Until a patch is applied, restricting network access to Oracle Applications Manager interfaces and monitoring for suspicious activity may reduce exposure.