This vulnerability affects Oracle Learning Management versions 12.2.3 to 12.2.15 in the Import And Export component. It permits a low privileged attacker with network access over HTTP to compromise the system, potentially leading to unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this vulnerability in the provided content.

Successful exploitation results in unauthorized access to critical or all accessible data within Oracle Learning Management. The impact is limited to confidentiality with no direct integrity or availability effects. This could lead to data exposure or leakage of sensitive information managed by Oracle Learning Management.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly and remaining on actively supported versions to mitigate exploitation risks. No specific temporary mitigations or workarounds are provided in the advisory content.