This vulnerability affects Oracle Contracts Integration versions 12.2.3 through 12.2.15. It is exploitable remotely over the network without authentication but requires high attack complexity and user interaction from someone other than the attacker. The impact includes limited confidentiality, integrity, and availability loss, such as unauthorized read and modification of some accessible data and partial denial of service. The CVSS vector is AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L. Oracle has published a Critical Patch Update advisory in July 2026 that includes multiple patches, but no explicit patch or remediation level is stated for this specific vulnerability in the provided data. Customers are advised to review the Oracle advisory for patch availability and apply updates promptly.

The vulnerability allows unauthorized attackers to gain limited unauthorized read, insert, update, or delete access to some data accessible via Oracle Contracts Integration. It may also cause a partial denial of service. The confidentiality, integrity, and availability impacts are all low to medium. Exploitation requires network access via HTTP and user interaction from a third party, making exploitation difficult.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance and patch availability. Oracle recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are detailed in the provided advisory content.