This vulnerability in Oracle Common Applications Calendar versions 12.2.3 allows an attacker with low privileges and network access via HTTP to compromise the application. Successful exploitation can lead to unauthorized read access to some data, unauthorized modification (update, insert, delete) of some data, and the ability to cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability.

The impact includes unauthorized ability to read a subset of accessible data, unauthorized ability to update, insert, or delete some accessible data, and the potential to cause a partial denial of service in Oracle Common Applications Calendar. The CVSS score of 6.3 reflects medium severity with confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No explicit patch or workaround details are provided in the advisory content for this specific vulnerability at this time.