This vulnerability affects Oracle Receivables versions 12.2.3 through 12.2.15 and allows a high privileged attacker with network access via HTTP to compromise the product. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-284 (Improper Access Control). The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch or remediation level for this specific vulnerability but recommends applying patches from the Critical Patch Update promptly. No exploits are currently known in the wild.

Successful exploitation can lead to complete compromise of Oracle Receivables, affecting confidentiality, integrity, and availability of the system. This could allow an attacker with high privileges and network access to take over the affected product, potentially impacting business operations relying on Oracle Receivables.

Patch status is not yet confirmed — check the Oracle Critical Patch Update July 2026 advisory for current remediation guidance. Oracle strongly recommends applying security patches from their Critical Patch Update program without delay to mitigate this and other vulnerabilities. Until a patch is confirmed and applied, limit network access to Oracle Receivables to trusted users and monitor for suspicious activity consistent with high privileged access misuse.