This vulnerability affects Oracle Price Protection versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data, and unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, limited confidentiality impact, high integrity impact, and no availability impact. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle advises customers to remain on supported versions and apply patches without delay.

An attacker with low privileges and network access via HTTP can gain unauthorized capabilities to create, delete, or modify critical data within Oracle Price Protection, as well as read some data without authorization. This compromises data integrity and confidentiality but does not affect availability. The impact is significant given the critical nature of the data involved.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.