This vulnerability affects Oracle Partner Management versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access over HTTPS to compromise the product by gaining unauthorized capabilities to update, insert, or delete certain accessible data, read some data subsets, and cause partial denial of service conditions. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability but references a July 2026 Critical Patch Update containing many security fixes. No known exploits in the wild have been reported.

Successful exploitation allows unauthorized read access to some data, unauthorized modification (update, insert, delete) of some accessible data, and the ability to cause a partial denial of service in Oracle Partner Management. This compromises confidentiality, integrity, and availability to a limited extent as indicated by the CVSS score and vector.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is applied, restrict network access to Oracle Partner Management to trusted users and monitor for unusual activity consistent with unauthorized data access or modification.