This vulnerability affects Oracle Price Protection versions 12.2.3 to 12.2.15 and permits a low-privileged attacker with network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Price Protection. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state the availability of a patch or remediation level for it. Oracle strongly recommends applying security patches without delay to mitigate such vulnerabilities.

The vulnerability allows unauthorized creation, deletion, or modification of critical data within Oracle Price Protection, as well as unauthorized access to all accessible data. This compromises the confidentiality and integrity of sensitive business data managed by Oracle Price Protection. There is no impact on availability. The vulnerability can be exploited remotely over the network by an attacker with low privileges and no user interaction is required.

Oracle's advisory for the July 2026 Critical Patch Update includes multiple security patches and recommends customers apply these patches promptly. Although no explicit patch or remediation level is stated for this specific vulnerability, applying the latest Critical Patch Update from Oracle is the recommended mitigation. Customers should ensure they are running actively-supported versions and apply Oracle security patches without delay. Patch status is not yet confirmed specifically for this vulnerability — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.