This vulnerability affects Oracle Item Master versions 12.2.3 to 12.2.15 and permits a low privileged attacker with network access via HTTP to gain unauthorized update, insert, delete, and read access to some accessible data within Oracle Item Master. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impact without availability impact. The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but strongly urges customers to apply available security patches from the July 2026 Critical Patch Update. The affected version explicitly stated is 12.2.3. No known exploits in the wild have been reported.

Successful exploitation allows unauthorized read and write (update, insert, delete) access to some data accessible via Oracle Item Master. This compromises confidentiality and integrity of the affected data but does not impact system availability. The attacker requires network access and low privileges, increasing the risk in environments where such access is possible.

The vendor advisory does not explicitly state a patch or remediation level for this vulnerability. Oracle strongly recommends applying the July 2026 Critical Patch Update and maintaining up-to-date security patches for Oracle products. Customers should verify patch availability and apply relevant updates promptly. Patch status is not yet confirmed for this specific vulnerability—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.