This vulnerability in Oracle SDP Number Portability (component: Internal Operations) allows an unauthenticated attacker to exploit the system over HTTP to compromise the product. Successful exploitation results in unauthorized access to critical or all accessible data within Oracle SDP Number Portability. The affected versions are 12.2.3 through 12.2.15 inclusive. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact with no integrity or availability impact. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory, which includes many patches across products, but no explicit patch link for this specific vulnerability was provided in the input data.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or potentially all data accessible through Oracle SDP Number Portability. This compromises confidentiality but does not affect integrity or availability. The vulnerability poses a significant risk to sensitive information managed by the affected Oracle product versions.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update, which addresses this and many other vulnerabilities. Customers should remain on actively supported versions and promptly apply Oracle security patches to mitigate this vulnerability. Since no specific patch link was provided, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions. No indication was given that the vulnerability is already mitigated or requires no action.