This vulnerability in Oracle Customers Online (version 12.2.3) enables a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no user interaction required. The vulnerability is publicly disclosed and listed in Oracle's July 2026 Critical Patch Update advisory, which includes numerous patches across Oracle products. However, the vendor advisory content does not explicitly confirm the availability of a patch or workaround for this specific vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Customers Online, compromising data confidentiality and integrity. There is no impact on system availability. The attacker requires network access and low privileges but no user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a specific patch is confirmed, monitor Oracle advisories for updates and apply any relevant Critical Patch Updates as they become available.