This vulnerability affects Oracle Cash Management versions 12.2.3 to 12.2.15 and is classified under CWE-284 (Improper Access Control). It permits a low privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical or all accessible data within Oracle Cash Management. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no user interaction required. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Cash Management. This leads to a high impact on confidentiality and integrity of the affected system's data. Availability is not impacted. The vulnerability can be exploited remotely over the network with low privileges and no user interaction.

The vendor advisory does not explicitly confirm the availability of a patch or remediation for this vulnerability. Oracle recommends applying Critical Patch Updates promptly and remaining on actively supported versions. Users should consult the Oracle July 2026 Critical Patch Update advisory for the latest patch availability and installation instructions. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.