This vulnerability affects Oracle Service Contracts versions 12.2.3 through 12.2.15. It is a difficult to exploit issue that requires a high privileged attacker with network access over HTTP and also requires user interaction from a third party. The vulnerability can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Service Contracts. The CVSS 3.1 base score is 5.7, indicating a medium severity with high confidentiality and integrity impacts but no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory does not explicitly state a patch or remediation level for this specific vulnerability but references the July 2026 Critical Patch Update advisory containing multiple patches across Oracle products.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Service Contracts, compromising confidentiality and integrity of the data. There is no impact on availability. The attack requires high privileges, network access via HTTP, and user interaction from a third party, making exploitation difficult. No known exploits in the wild have been reported.

Patch status is not yet confirmed for this specific vulnerability; the Oracle July 2026 Critical Patch Update advisory should be consulted for current patch availability and installation instructions. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, organizations should limit network access to Oracle Service Contracts and monitor for suspicious activity involving high privileged accounts. No vendor advisory states that no action is required or that the issue is already mitigated.