This vulnerability affects Oracle Performance Management versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access over HTTP to perform unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory does not explicitly confirm patch availability or remediation status for this specific issue but references a Critical Patch Update released in July 2026 covering multiple vulnerabilities. Users are advised to consult the Oracle advisory for patch details.

Successful exploitation allows unauthorized read and write access to some data within Oracle Performance Management, potentially leading to data modification or disclosure. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires network access and low privileges but no user interaction.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Performance Management interfaces where possible to limit exposure.