This vulnerability affects Oracle iSupport versions 12.2.3 through 12.2.15 and allows an attacker with low privileges and network access via HTTP to gain unauthorized update, insert, delete, and read access to certain Oracle iSupport accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Customers are advised to remain on supported versions and apply security patches without delay.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Oracle iSupport. This compromises confidentiality and integrity of affected data but does not affect availability. The vulnerability requires network access and low privileges, making it moderately risky but not critical.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. Users should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.