This vulnerability in Oracle Customers Online enables an attacker with low privileges and network access over HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or full access to all data accessible through Oracle Customers Online. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) highlights network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Affected versions explicitly include 12.2.3 through 12.2.15. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible via Oracle Customers Online. This compromises confidentiality and integrity of sensitive business data, potentially impacting business operations and data trustworthiness. There is no reported impact on availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Customers Online to trusted users and monitor for suspicious activity consistent with unauthorized data modification or access.