This vulnerability in Oracle Sales Offline (component: Internal Operations) allows an attacker with low privileges and network access via HTTP to compromise the system. The affected versions are 12.2.3 through 12.2.15. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes patches for this vulnerability among 1449 security fixes across multiple products. No explicit patch link or remediation level is stated in the CVE data, but the vendor advisory strongly recommends applying the available patches promptly.

Successful exploitation results in complete compromise of Oracle Sales Offline, affecting confidentiality, integrity, and availability of the system. This can lead to full takeover of the affected product, potentially allowing attackers to access sensitive data, modify or disrupt operations.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Customers are strongly advised to apply these security patches without delay to mitigate the risk. No alternative mitigations or temporary fixes are indicated. Patch status is confirmed by the vendor advisory. Users should verify patch availability and installation instructions via the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html.