This vulnerability exists in the Quality Management Specs component of Oracle Process Manufacturing Product Development versions 12.2.3 to 12.2.15. It allows an attacker with low privileges and network access via HTTP to fully compromise the product, affecting confidentiality, integrity, and availability (CVSS 3.1 score 8.8). The vulnerability is included in Oracle's June 2026 Critical Security Patch Update, which addresses 245 security issues across Oracle products. Oracle advises customers to apply the patches immediately to prevent exploitation. No official remediation level is stated, but the vendor advisory confirms patch availability as part of the Critical Security Patch Update. Mitigation may include blocking required network protocols and removing unnecessary privileges until patches are applied.

Successful exploitation can lead to complete takeover of Oracle Process Manufacturing Product Development, impacting confidentiality, integrity, and availability of the system. This could allow attackers to access sensitive data, modify or disrupt operations, and fully control the affected product component.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges from users. Oracle emphasizes staying on actively supported versions and promptly applying security updates to prevent exploitation.