This vulnerability exists in the User Interface component of Oracle Customer Interaction History versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access over HTTPS to compromise the system, potentially resulting in complete takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes a fix for this vulnerability among 673 security patches. Oracle strongly recommends applying these patches without delay to prevent exploitation.

The vulnerability can lead to full compromise of Oracle Customer Interaction History, impacting confidentiality, integrity, and availability of the system. An attacker with network access and low privileges can exploit this flaw remotely via HTTPS to take over the affected product. This could allow unauthorized access to sensitive customer interaction data and control over the application.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the official patch promptly to remediate the issue. Oracle strongly advises remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.