This vulnerability in Oracle Marketing 12.2.3 allows an attacker with low privileges and network access over HTTP to compromise the product by gaining unauthorized read and write access to certain data and causing partial denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. The vendor advisory from Oracle (July 2026 Critical Patch Update) lists this vulnerability but does not explicitly confirm patch availability or remediation status for Oracle Marketing 12.2.3. Patch status is therefore not confirmed and should be verified with Oracle's advisory.

Successful exploitation can lead to unauthorized update, insertion, or deletion of some Oracle Marketing accessible data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service affecting availability. The impact affects confidentiality, integrity, and availability but at a low level each, consistent with the medium CVSS score.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability but does not explicitly state patch availability or remediation for Oracle Marketing 12.2.3. Customers should consult the Oracle advisory directly for the latest patch information and apply any available security patches promptly. Until patch confirmation, monitor Oracle's official security alerts for updates. No vendor statement indicates that no action is required or that the issue is already mitigated.