This vulnerability affects Oracle Advanced Benefits 12.2.15, allowing a low privileged attacker with network access via HTTP to compromise the system. The attack can result in unauthorized creation, deletion, or modification of critical data, impacting data integrity. The vulnerability scope may extend to other Oracle products. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, no confidentiality impact, high integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. Patch status is therefore not yet confirmed; users should verify the vendor advisory for current remediation guidance.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data in Oracle Advanced Benefits 12.2.15, compromising data integrity. The vulnerability can be exploited remotely over the network with low privileges and no user interaction. The scope change indicates potential impact on additional Oracle products beyond Oracle Advanced Benefits. There is no reported impact on confidentiality or availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance and patch availability. Oracle strongly recommends applying security patches promptly to mitigate this and other vulnerabilities. Until a patch is applied, restrict network access to Oracle Advanced Benefits instances where possible and monitor for suspicious activity related to unauthorized data modifications.