This vulnerability in Oracle SDP Number Portability (component: Internal Operations) allows a low privileged attacker with logon access to the infrastructure to compromise the product, potentially leading to full takeover. The vulnerability affects versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates that the attack requires local access with low complexity and privileges but results in high confidentiality, integrity, and availability impacts with scope change. Although the vulnerability is specific to Oracle SDP Number Portability, exploitation may affect additional Oracle products. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch for this specific vulnerability but strongly recommends applying all available security patches promptly.

Successful exploitation can result in full compromise and takeover of Oracle SDP Number Portability, impacting confidentiality, integrity, and availability of the affected system. Due to scope change, additional Oracle products may also be significantly impacted. The vulnerability requires local access with low privileges but can escalate to complete control over the component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle's July 2026 Critical Patch Update advisory strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Organizations should monitor Oracle's security alerts and apply Critical Patch Updates promptly once patches for this vulnerability are released.