This vulnerability affects Oracle Contracts Integration versions 12.2.3 to 12.2.15 and allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation requires user interaction from a third party. The attacker can gain unauthorized ability to create, delete, or modify critical data within Oracle Contracts Integration and cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact. Oracle has published this vulnerability in their July 2026 Critical Patch Update advisory but has not explicitly stated patch availability or remediation status for this specific issue in the provided advisory content.

The vulnerability can lead to unauthorized modification of critical data in Oracle Contracts Integration and partial denial of service. There is no confidentiality impact. The integrity of data is highly impacted, and availability is affected to a lesser extent. Exploitation requires user interaction, which limits the attack vector somewhat but still poses a significant risk due to the unauthenticated network access.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit network exposure of Oracle Contracts Integration and educate users to avoid interacting with suspicious content that could trigger exploitation.