This vulnerability affects Oracle Service Fulfillment Manager versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 base score is 7.5, indicating high severity, with impacts on confidentiality, integrity, and availability. The attack complexity is high, and no user interaction is required. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle advises customers to remain on supported versions and apply security patches without delay.

Successful exploitation can lead to complete compromise of Oracle Service Fulfillment Manager, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially impacting business operations relying on it.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly and remaining on actively supported versions to mitigate risks. No specific patch or temporary fix is explicitly stated for this vulnerability in the advisory.