This vulnerability affects Oracle Project Contracts versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. Successful exploitation can result in unauthorized creation, deletion, or modification of all accessible Oracle Project Contracts data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no user interaction required. The vulnerability is publicly disclosed and listed in Oracle's July 2026 Critical Patch Update advisory, which includes a large number of patches across Oracle products. However, the advisory does not explicitly confirm the availability of a specific patch for this vulnerability or provide direct remediation instructions.

The vulnerability allows unauthorized access to critical data within Oracle Project Contracts, including the ability to create, delete, or modify such data. This compromises the confidentiality and integrity of the affected system's data. There is no impact on availability. The attacker requires only low privileges and network access via HTTP, making exploitation relatively easy if the system is exposed.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across its products, including Oracle Project Contracts. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Since the advisory is the authoritative source, and no explicit patch status for this vulnerability is stated, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Maintaining up-to-date patches and using supported versions is recommended.