This vulnerability affects Oracle Service Delivery Platform version 14.1.2.0.0. An unauthenticated attacker with network access over HTTP can exploit this flaw to gain unauthorized read access to some data and unauthorized update, insert, or delete access to other data within the platform. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity but not availability. The vulnerability is identified as CWE-284 (Improper Access Control).

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through the Service Delivery Platform, potentially compromising data confidentiality and integrity. There is no reported impact on system availability. The vulnerability is exploitable remotely without authentication, increasing its risk profile.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update (CSPU). Customers are strongly advised to apply the relevant security patches promptly to remediate this issue. Oracle recommends remaining on actively supported versions and applying patches without delay to prevent exploitation. Patch availability details can be found in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or workarounds are specified.