This vulnerability in Oracle Sales for Handhelds (component: Internal Operations) allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The affected versions are from 12.2.3 up to and including 12.2.15. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes 943 security patches across multiple products. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Sales for Handhelds, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, data modification, and service disruption.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers should apply the relevant patches from this update promptly. Oracle strongly recommends staying on actively-supported versions and applying security patches without delay to prevent exploitation. No additional mitigation steps are specified beyond patching.