This vulnerability affects Oracle iSupport versions 12.2.3 through 12.2.15 and allows an unauthenticated attacker with network access via HTTP to compromise the product. Exploitation requires human interaction from a user other than the attacker. The impact includes unauthorized modification (update, insert, delete) and unauthorized read access to certain Oracle iSupport data. The vulnerability has a scope change, meaning it may affect additional Oracle products beyond iSupport. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, and no availability impact. Oracle’s Critical Patch Update advisory for July 2026 references many patches but does not explicitly confirm a patch for this vulnerability in the provided excerpt. Customers are advised to review the advisory and apply patches promptly if available.

Successful exploitation can result in unauthorized update, insertion, or deletion of some Oracle iSupport accessible data, as well as unauthorized read access to a subset of that data. The vulnerability also has a scope change, potentially impacting additional Oracle products beyond iSupport. The confidentiality and integrity of affected data are at risk, but availability is not impacted. The CVSS score of 6.1 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends customers remain on actively-supported versions and apply security patches without delay. Until a patch is confirmed and applied, limit network exposure of Oracle iSupport and monitor for suspicious activity requiring user interaction. No vendor advisory states that no action is required or that the vulnerability is already mitigated.