This vulnerability affects Oracle Complex Maintenance, Repair and Overhaul versions 12.2.3 through 12.2.15. It is a difficult to exploit issue that allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially resulting in unauthorized access to critical data and limited unauthorized data modification. The vulnerability impacts confidentiality and integrity but not availability, and the scope of impact may extend to additional Oracle products. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation details for this specific issue. Customers are urged to remain on supported versions and apply security patches without delay.

Successful exploitation can lead to unauthorized access to critical data within Oracle Complex Maintenance, Repair and Overhaul and unauthorized update, insert, or delete operations on some accessible data. The confidentiality impact is high, integrity impact is low, and availability is not affected. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond the initially affected component.

Oracle's advisory does not explicitly confirm a patch or remediation level for this vulnerability. Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends customers remain on actively supported versions and apply Critical Patch Updates promptly to mitigate this and other vulnerabilities. No vendor advisory states that no action is required or that the issue is already mitigated.