This vulnerability affects Oracle Enterprise Asset Management versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. Exploitation requires user interaction from a third party and can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 score of 7.6. Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability among 943 other security patches. Customers are urged to apply these patches without delay to mitigate the risk.

Successful exploitation can lead to unauthorized access to critical data within Oracle Enterprise Asset Management and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of the vulnerability extends beyond Oracle Enterprise Asset Management to potentially impact additional Oracle products. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official Oracle patches promptly to remediate this issue. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative or temporary mitigations are stated in the advisory; patching is the primary remediation.