This vulnerability affects Oracle Process Manufacturing Product Development versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product, resulting in complete takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The scope of the vulnerability extends beyond the immediate product, potentially affecting additional Oracle products. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability among 245 other security patches. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to full compromise of Oracle Process Manufacturing Product Development, including takeover of the product with high impact on confidentiality, integrity, and availability. The vulnerability also has a scope change, meaning it may significantly affect other Oracle products beyond the initially vulnerable component.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the June 2026 Critical Security Patch Update promptly to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation and by removing unnecessary privileges from users. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory, indicating an official fix is available.