This vulnerability affects Oracle Teleservice versions 12.2.3 through 12.2.15 and allows unauthenticated attackers with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized update, insert, or delete operations on some Oracle Teleservice accessible data, as well as unauthorized read access to a subset of that data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, with low confidentiality and integrity impacts and no availability impact. The vendor advisory from Oracle references this vulnerability as part of the July 2026 Critical Patch Update but does not explicitly state patch availability or remediation details specific to Oracle Teleservice.

An attacker can remotely and without authentication access Oracle Teleservice via HTTP to read and modify certain accessible data. This compromises confidentiality and integrity of some data within Oracle Teleservice. There is no reported impact on system availability. The vulnerability is rated medium severity with a CVSS score of 6.5.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a patch or official fix for Oracle Teleservice. Users should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is applied, organizations should consider restricting network access to Oracle Teleservice HTTP interfaces to trusted users only. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.