This vulnerability affects Oracle Landed Cost Management versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data or full access to all accessible data within Oracle Landed Cost Management, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's Critical Security Patch Update advisory for August 2026 includes patches addressing this vulnerability among many others. The vendor strongly recommends applying patches without delay to avoid exploitation.

An attacker with low privileges and network access via HTTP can gain unauthorized access to critical data or complete access to all data accessible by Oracle Landed Cost Management. Additionally, the attacker can perform unauthorized update, insert, or delete operations on some of the accessible data. This compromises confidentiality and integrity of the data but does not affect availability.

Oracle has released a Critical Security Patch Update advisory in August 2026 that addresses this vulnerability among others. Customers should apply the relevant security patches from this update promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory, indicating that a fix is available.