This vulnerability exists in Oracle Sales Offline versions 12.2.3 through 12.2.15 and allows a high-privileged attacker with network access via HTTP to compromise the product. The vulnerability is difficult to exploit but can result in complete takeover of Oracle Sales Offline. The scope of impact extends beyond Oracle Sales Offline to other Oracle products. The CVSS 3.1 vector indicates network attack vector, high attack complexity, required high privileges, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among 1449 patches but does not explicitly state the patch status for this specific CVE in the provided content. Customers are advised to review the advisory and apply relevant patches.

Successful exploitation can lead to complete compromise of Oracle Sales Offline, affecting confidentiality, integrity, and availability of the system. The vulnerability's impact scope includes potential significant effects on additional Oracle products beyond Oracle Sales Offline. The attack requires high privileges and network access via HTTP, making exploitation difficult but impactful if achieved.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among many others. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. Applying the relevant patches promptly is strongly recommended. No explicit remediation level or temporary fix is stated in the advisory content provided. Patch status is not yet confirmed in the input data; therefore, users must verify current remediation guidance from the vendor advisory.