This vulnerability affects Oracle Price Protection versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle Price Protection, as well as unauthorized read access to a subset of that data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. The vendor advisory from Oracle references a Critical Patch Update containing many patches but does not explicitly confirm a patch or fix for this specific vulnerability. Patch status is therefore not confirmed and should be verified with Oracle's advisory.

The vulnerability allows unauthorized users with low privileges and network access to perform unauthorized creation, deletion, or modification of critical data in Oracle Price Protection, as well as unauthorized read access to some data. This compromises the confidentiality and integrity of the affected system's data, potentially impacting business operations relying on Oracle Price Protection data. There is no reported impact on system availability.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Price Protection interfaces to trusted users only and monitor for suspicious activity related to unauthorized data access or modification.