This vulnerability affects Oracle Public Sector Financials versions 12.2.3 through 12.2.15 and involves the Internal Operations component. It is exploitable by an attacker with low privileges who can access the system over HTTP, though exploitation is considered difficult. Successful exploitation can lead to full compromise of the Oracle Public Sector Financials application. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory lists this vulnerability among many others but does not provide explicit patch or remediation details for this specific CVE in the excerpt provided.

If exploited, this vulnerability can result in complete takeover of Oracle Public Sector Financials, impacting confidentiality, integrity, and availability of the affected system. The attacker requires only low privileges and network access via HTTP, but the attack complexity is high, making exploitation difficult. There are no known exploits in the wild at this time.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and apply relevant patches promptly. Since the vendor advisory does not explicitly confirm patch availability or temporary fixes for this specific vulnerability in the provided content, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Maintaining up-to-date patches on supported versions is recommended to mitigate this vulnerability.