This vulnerability affects Oracle Loans versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Loans. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with low attack complexity and no user interaction required. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but is part of Oracle's July 2026 Critical Patch Update advisory, which includes numerous patches across Oracle products. Oracle urges customers to remain on supported versions and apply patches without delay.

The vulnerability allows unauthorized access to critical data within Oracle Loans, including the ability to create, delete, or modify such data. This compromises the confidentiality and integrity of the affected system's data. There is no impact on availability reported. The attack requires network access via HTTP and low privileges, making it relatively easy to exploit.

The vendor advisory does not explicitly state a patch or remediation level for this vulnerability. Oracle's July 2026 Critical Patch Update advisory includes numerous patches and strongly recommends customers apply security patches promptly to mitigate vulnerabilities. Users of Oracle Loans versions 12.2.3 through 12.2.15 should monitor Oracle's official security alerts and apply relevant patches as soon as they become available. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.