This vulnerability in Oracle Risk Management (component: Internal Operations) affects supported versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access over HTTP to compromise the system, potentially resulting in complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory includes fixes for this vulnerability among 943 patches across multiple products. The vendor strongly recommends applying patches without delay to prevent exploitation.

Successful exploitation can lead to full compromise of Oracle Risk Management, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized access and control over sensitive risk management operations.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the relevant patches from this update promptly. Oracle emphasizes the importance of staying on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.