This vulnerability affects Oracle iSetup versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all Oracle iSetup accessible data. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vulnerability is described as difficult to exploit. The vendor advisory from Oracle’s July 2026 Critical Patch Update mentions many patches but does not explicitly confirm a patch or remediation for this specific vulnerability. Customers are advised to apply available patches promptly, but patch status for this vulnerability is not explicitly confirmed in the advisory.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle iSetup. This compromises confidentiality and integrity of the data but does not affect availability. The vulnerability requires network access via HTTP and low privileges, with a high attack complexity, making exploitation difficult but possible. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Until a patch is confirmed and applied, restrict network access to Oracle iSetup interfaces and monitor for suspicious activity related to unauthorized data modification attempts.