This vulnerability in Oracle Lease and Finance Management version 12.2.11 allows a low privileged attacker with network access via HTTP to compromise the system. The attack complexity is high, requiring specific conditions, but successful exploitation can lead to complete takeover of the product, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H with a base score of 7.5. Oracle's July 2026 Critical Patch Update advisory lists numerous patches across many products but does not explicitly confirm a patch or fix for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of Oracle Lease and Finance Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized data access and disruption of services.

Oracle has included this vulnerability in their July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or fix for this specific vulnerability. Customers should review the Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply relevant patches promptly. Until a patch is confirmed and applied, organizations should limit network exposure of Oracle Lease and Finance Management and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.