This vulnerability affects Oracle Project Contracts versions 12.2.3 to 12.2.15 and involves unauthorized read access to a subset of accessible data. The attack vector is network-based via HTTP, requiring low privileges but high attack complexity. The CVSS 3.1 base score is 3.1, reflecting limited confidentiality impact without integrity or availability effects. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch or remediation for this specific vulnerability, though it strongly recommends applying available patches for all vulnerabilities. No known exploits in the wild have been reported.

Successful exploitation results in unauthorized read access to some data within Oracle Project Contracts. There is no impact on data integrity or availability. The confidentiality impact is limited, and exploitation is considered difficult due to high attack complexity and the need for network access.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying all relevant security patches promptly and remaining on actively supported versions. No specific workaround or temporary fix is provided in the advisory.