This vulnerability in Oracle Applications Framework's Upload Attachments component affects supported versions 12.2.8 to 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the framework, contingent on user interaction from a third party. The impact includes unauthorized ability to read and modify some accessible data within the framework. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, required user interaction, unchanged scope, and limited confidentiality and integrity impacts without availability impact. No official patch or remediation level is confirmed in the advisory, and no known exploits in the wild have been reported. Oracle's July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a fix for this CVE at this time.

The vulnerability allows unauthorized read and modification (update, insert, delete) access to some data accessible via Oracle Applications Framework. This could lead to data confidentiality and integrity issues but does not affect availability. Exploitation requires user interaction, limiting the attack vector. The CVSS score of 4.6 reflects a medium severity impact.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is confirmed, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.