This vulnerability in Oracle Sales Offline (component: Internal Operations) allows an attacker with low privileges and network access via HTTP to compromise the product. The vulnerability affects supported versions 12.2.3 through 12.2.15. The CVSS 3.1 vector indicates network attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this and other vulnerabilities. However, the vendor advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability within the advisory text provided.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Sales Offline, resulting in complete loss of confidentiality, integrity, and availability of the affected product. This can lead to unauthorized data access, modification, and service disruption.

Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple vulnerabilities. Customers are strongly advised to remain on actively supported versions and apply Oracle's security patches without delay. Patch status for this specific vulnerability is not explicitly confirmed in the advisory content provided; therefore, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions.