This vulnerability affects Oracle Advanced Benefits versions 12.2.4 through 12.2.15. It enables an attacker with low privileges and network access via HTTP to compromise the application by gaining unauthorized ability to read, modify, or delete some accessible data. Additionally, the attacker can cause a partial denial of service condition. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. No specific patch or remediation level is confirmed from the vendor advisory, but Oracle's July 2026 Critical Patch Update advisory references multiple patches and strongly recommends applying security patches promptly.

Successful exploitation can lead to unauthorized read access to some data, unauthorized update, insert, or delete access to some data within Oracle Advanced Benefits, and the ability to cause a partial denial of service. The impact affects confidentiality, integrity, and availability at a low level, with a medium severity rating.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Until a patch is applied, limit network access to Oracle Advanced Benefits to trusted users and monitor for unusual activity consistent with unauthorized data access or modification.