This vulnerability affects Oracle Applications Framework versions 12.2.3 through 12.2.15, specifically in the Graph / Charting component. It enables a low privileged attacker with network access via HTTP to compromise the framework, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Applications Framework. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory does not explicitly confirm a patch for this specific vulnerability but strongly recommends applying security patches from the July 2026 Critical Patch Update and staying on supported versions.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Applications Framework, as well as unauthorized access to all data accessible by the framework. This compromises confidentiality and integrity of the affected data. Availability is not impacted. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

The vendor advisory for the July 2026 Critical Patch Update recommends applying all relevant security patches promptly and remaining on actively supported versions. Although no explicit patch or remediation level is stated for this vulnerability, customers should review the July 2026 Critical Patch Update documentation and apply any applicable patches for Oracle Applications Framework versions 12.2.3 through 12.2.15 without delay. No alternative mitigations or workarounds are provided in the advisory.