This vulnerability affects Oracle Sales Offline versions 12.2.3 to 12.2.15 and allows an attacker with low privileges and network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Sales Offline. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no required user interaction. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory is a general Critical Patch Update advisory listing many products but does not explicitly state patch availability or remediation details for Oracle Sales Offline.

An attacker with low privileges and network access can exploit this vulnerability to gain unauthorized access to critical data within Oracle Sales Offline, including the ability to create, delete, or modify data. This compromises the confidentiality and integrity of the data but does not affect availability. The impact is significant given the potential for complete data compromise within the affected product.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate vulnerabilities. Until a patch is confirmed and applied, restrict network access to Oracle Sales Offline and monitor for unusual activity consistent with unauthorized data access attempts.