This vulnerability in Oracle Product Hub 12.2.3 allows an attacker with low privileges and network access via HTTP to compromise the product by gaining unauthorized read and write access to some data and causing partial denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update for July 2026 covering many products but does not explicitly confirm patch availability or remediation details for this CVE.

Successful exploitation can lead to unauthorized update, insert, or delete operations on some Oracle Product Hub accessible data, unauthorized read access to a subset of data, and partial denial of service affecting availability. The impact affects confidentiality, integrity, and availability to a limited extent as reflected by the CVSS score of 6.3.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. No explicit patch or workaround for this specific vulnerability is detailed in the provided advisory content.