This vulnerability in Oracle Property Manager (component: Internal Operations) affects supported versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized update, insert, delete, and read access to some data accessible by Oracle Property Manager. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impacts on confidentiality and integrity but not availability. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle strongly recommends applying patches from their Critical Patch Updates to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data within Oracle Property Manager. This compromises data confidentiality and integrity but does not affect system availability. The vulnerability requires network access and low privileges, making it relatively easy to exploit if the attacker can reach the service over HTTP.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay to address vulnerabilities in Oracle products. Although no explicit patch or remediation level is stated for this vulnerability, customers should verify and apply the latest Critical Patch Updates from Oracle to mitigate this issue. Until patched, restricting network access to Oracle Property Manager and monitoring for unusual activity may help reduce risk.