This vulnerability affects Oracle Bills of Material versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. Exploitation requires user interaction from a third party. The impact includes complete takeover of the Oracle Bills of Material component. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, and high confidentiality, integrity, and availability impacts. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others and strongly recommends applying patches promptly. However, the advisory content provided does not specify a particular patch version or remediation details for this vulnerability.

Successful exploitation can result in complete compromise of Oracle Bills of Material, affecting confidentiality, integrity, and availability of the system. The attacker requires low privileges and network access but needs a user other than themselves to interact to trigger the exploit. This can lead to full takeover of the affected Oracle component.

Oracle's Critical Patch Update advisory for July 2026 includes this vulnerability and recommends applying the security patches provided in the update without delay. Since no explicit patch version is stated in the provided data, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Maintaining up-to-date patches is the primary mitigation. No vendor advisory states that no action is required or that the issue is already mitigated.