This vulnerability in Oracle Bills of Material version 12.2.3 allows an attacker with low privileges and network access via HTTP to compromise the product by gaining unauthorized ability to read, update, insert, or delete some accessible data. Additionally, the attacker can cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update notice listing many products and versions but does not explicitly confirm a patch or remediation status for this vulnerability. Patch status is therefore not confirmed and should be verified by consulting the vendor advisory directly.

Successful exploitation can lead to unauthorized read access to some data, unauthorized modification (update, insert, delete) of some data, and partial denial of service of Oracle Bills of Material. This impacts confidentiality, integrity, and availability to a limited extent as reflected by the CVSS score of 6.3.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No explicit temporary mitigations or workarounds are provided in the advisory content.