This vulnerability affects Oracle Price Protection versions 12.2.3 through 12.2.15 and permits a low-privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Price Protection. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is publicly disclosed and listed in Oracle's July 2026 Critical Patch Update advisory, which includes patches for this and many other vulnerabilities.

An attacker with low privileges and network access can exploit this vulnerability to gain unauthorized access to critical data within Oracle Price Protection, including the ability to create, delete, or modify such data. This compromises the confidentiality and integrity of the affected system's data, potentially leading to significant business impact due to data manipulation or exposure.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches from the Oracle Critical Patch Update without delay. No alternative mitigations or temporary fixes are specified. Patch status is confirmed by the vendor advisory. Staying on actively supported versions and promptly applying Oracle patches is essential to mitigate this risk.