This vulnerability affects Oracle Contracts Integration versions including 12.2.3 and allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation requires user interaction from a third party and can lead to unauthorized update, insert, or delete access to some Oracle Contracts Integration data, as well as unauthorized read access to a subset of that data. The vulnerability has a CVSS 3.1 score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impacts. The vulnerability may also affect other Oracle products due to scope change. No official remediation level or patch availability is explicitly stated in the advisory, but Oracle's July 2026 Critical Patch Update advisory references multiple patches across products and strongly recommends applying patches promptly.

An unauthenticated attacker with network access can exploit this vulnerability to gain unauthorized update, insert, or delete access to some data within Oracle Contracts Integration, as well as unauthorized read access to a subset of that data. The attack requires user interaction from a person other than the attacker. The vulnerability's scope change means it may impact additional Oracle products beyond Oracle Contracts Integration. The CVSS score of 6.1 reflects medium severity with confidentiality and integrity impacts but no availability impact.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing multiple vulnerabilities, including those affecting Oracle Contracts Integration. Although no explicit patch link or remediation level is provided for this specific vulnerability, Oracle strongly recommends applying the latest Critical Patch Update patches without delay and remaining on actively supported versions. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Until patches are applied, be aware that exploitation requires user interaction, which may reduce risk in some environments.