This vulnerability affects Oracle Transportation Management 6.5.3, specifically in the Integration component of Oracle Supply Chain. It allows a high privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data or gain complete access to all data accessible by Oracle Transportation Management. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without affecting availability. No official patch or remediation level is stated in the vendor advisory, and no known exploits in the wild have been reported as of the publication date. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

An attacker with high privileges and network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification rights over critical data in Oracle Transportation Management 6.5.3. This can lead to unauthorized access to sensitive or critical data and compromise the integrity and confidentiality of the system's data. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and remaining on actively supported versions. Since no explicit patch or temporary fix is stated for this vulnerability, monitor Oracle advisories for updates and apply patches as soon as they become available.