This vulnerability affects Oracle TeleSales versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access via HTTP to compromise the product. The attacker can gain unauthorized creation, deletion, or modification access to critical data or all data accessible by Oracle TeleSales. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no required user interaction and low attack complexity. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Customers are advised to review the advisory and apply patches promptly if available.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle TeleSales, as well as unauthorized access to all data accessible by the product. This compromises both confidentiality and integrity of the affected system's data. Availability is not impacted according to the CVSS vector.

The vendor advisory does not explicitly confirm the availability of a patch for this vulnerability. Oracle recommends customers remain on actively-supported versions and apply security patches without delay. Users should monitor the Oracle Critical Patch Update advisories, specifically the July 2026 update, for patch availability and installation instructions. Until a patch is confirmed, no specific workaround or temporary fix is provided by the vendor.