This vulnerability affects Oracle Knowledge Management versions 12.2.5 through 12.2.15. It is exploitable remotely over HTTP without authentication but requires user interaction. The attack scope includes unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible by Oracle Knowledge Management. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond Knowledge Management. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, and no availability impact. No official remediation level or patch information is explicitly stated in the advisory content provided. The vendor advisory references Oracle's Critical Patch Update for July 2026 but does not explicitly confirm patch availability for this specific vulnerability.

Successful exploitation can result in unauthorized read access to some data and unauthorized update, insert, or delete operations on Oracle Knowledge Management data. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires user interaction, limiting automated exploitation. The scope change indicates potential impact on other Oracle products integrated with Oracle Knowledge Management.

Patch status is not yet confirmed — check the Oracle Critical Patch Update Advisory for July 2026 at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until patches are confirmed and applied, limit network exposure of Oracle Knowledge Management interfaces and educate users to avoid interacting with suspicious content that could trigger exploitation.