This vulnerability affects Oracle Transportation Execution versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product by gaining unauthorized update, insert, delete, and read access to some accessible data. Exploitation requires user interaction from a third party. The vulnerability has a scope change, meaning it may affect other Oracle products beyond Transportation Execution. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope change, and limited confidentiality and integrity impacts. No official patch or remediation level is explicitly stated in the vendor advisory, and no known exploits in the wild have been reported. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized read access of data within Oracle Transportation Execution. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products may also be affected indirectly. The requirement for user interaction limits the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Since no explicit patch or workaround is stated for this vulnerability, monitoring Oracle advisories for updates is advised. No vendor advisory states that no action is required or that the issue is already mitigated.