This vulnerability affects Oracle Proposals versions 12.2.3 through 12.2.15 and permits an attacker with low privileges and network access via HTTP to compromise the application. Successful exploitation can lead to unauthorized reading and modification (update, insert, delete) of some accessible data within Oracle Proposals, as well as the ability to cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions a large number of security patches but does not explicitly state a fix for this vulnerability, and remediation level is not provided. Customers are urged to apply available patches promptly as per Oracle's general guidance.

An attacker with network access and low privileges can gain unauthorized read and write access to some data in Oracle Proposals, potentially modifying or deleting data improperly. Additionally, the attacker can cause a partial denial of service affecting availability of the Oracle Proposals component. The confidentiality, integrity, and availability impacts are rated low but combined justify a medium severity rating (CVSS 6.3). No evidence of active exploitation in the wild has been reported.

Oracle's advisory strongly recommends that customers remain on actively supported versions and apply security patches without delay. However, the provided advisory content does not explicitly confirm the availability of a patch or temporary fix for this specific vulnerability. Therefore, patch status is not yet confirmed—check the Oracle Critical Patch Update July 2026 advisory and related documentation for current remediation guidance. Until a patch is applied, limit network access to Oracle Proposals where possible and monitor for unusual activity related to this component.