This vulnerability affects Oracle Lease and Finance Management version 12.2.14 and involves an easily exploitable flaw that permits a high privileged attacker with network access via HTTP to compromise the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm a patch or remediation level for this specific vulnerability. Customers are strongly advised to review the advisory and apply any relevant patches promptly.

Successful exploitation can lead to complete compromise of Oracle Lease and Finance Management, affecting confidentiality, integrity, and availability of the system. This could result in unauthorized access, data manipulation, and service disruption within the affected product environment.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches without delay and remaining on actively-supported versions. No specific temporary mitigations or workarounds are provided in the advisory.