This vulnerability affects Oracle Service Contracts versions 12.2.3 through 12.2.15 and involves a flaw in the Internal Operations component. A high privileged attacker with network access via HTTP could exploit this vulnerability, but exploitation is difficult and requires user interaction from a third party. The impact includes unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible through Oracle Service Contracts. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) reflects network attack vector, high attack complexity, high privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact without availability impact. No official patch or remediation level is stated in the advisory, and no known exploits in the wild have been reported. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability for it. Customers are advised to consult the vendor advisory for patch status and apply updates promptly.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Service Contracts, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive data. The vulnerability does not impact availability. Exploitation requires high privileges and user interaction, making it harder to exploit.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Since no explicit patch or temporary fix is stated for this vulnerability, monitor vendor communications for updates. No vendor advisory states that no action is required or that the issue is already mitigated.