This vulnerability affects Oracle Partner Management versions 12.2.3 through 12.2.15. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise Oracle Partner Management. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Partner Management, as well as unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 base score of 7.1 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this and many other vulnerabilities.

Successful exploitation of this vulnerability can result in unauthorized access to critical data within Oracle Partner Management and potentially other products due to scope change. Attackers may gain complete access to all data accessible by Oracle Partner Management and perform unauthorized update, insert, or delete operations on some of this data. The impact affects confidentiality and integrity but not availability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the available security patches without delay to mitigate the risk. Oracle recommends remaining on actively supported versions and promptly applying patches as Oracle does not report any known exploits in the wild for this vulnerability at this time.