This vulnerability affects Oracle Interaction Blending versions 12.2.3 to 12.2.15 and involves a difficult to exploit flaw that permits a high privileged attacker with network access via RMI to compromise the product. Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized read access to some accessible data, along with the ability to cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, high attack complexity, required high privileges, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L). The vendor advisory from Oracle does not explicitly confirm patch availability or remediation status for this specific vulnerability but references a Critical Patch Update released in July 2026 covering multiple products. Customers are advised to consult the vendor advisory for patch details.

An attacker with high privileges and network access via RMI can gain unauthorized ability to update, insert, delete, and read some data accessible through Oracle Interaction Blending. Additionally, the attacker can cause a partial denial of service affecting availability. The impact on confidentiality, integrity, and availability is low but unauthorized data manipulation and partial service disruption are possible.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle recommends applying security patches promptly and staying on actively supported versions. Until a patch is confirmed, limit network access to Oracle Interaction Blending services and ensure only trusted, high privileged users have access via RMI.