This vulnerability affects Oracle Interaction Blending versions 12.2.3 through 12.2.15 and involves improper access control (CWE-284) that can be exploited by a high privileged attacker with network access via RMI. Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized read access to some data, as well as partial denial of service conditions. The CVSS 3.1 vector indicates network attack vector, high attack complexity, required high privileges, no user interaction, unchanged scope, and low confidentiality, integrity, and availability impacts. Oracle has published a Critical Patch Update advisory in July 2026 but does not explicitly confirm a patch for this specific vulnerability in the provided advisory content.

An attacker with high privileges and network access via RMI can exploit this vulnerability to gain unauthorized ability to update, insert, or delete some accessible data, read a subset of data without authorization, and cause a partial denial of service on Oracle Interaction Blending. The impact on confidentiality, integrity, and availability is low but non-negligible. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until an official patch is confirmed, restrict network access to Oracle Interaction Blending services and ensure that only trusted, high privileged users have network access via RMI.