This vulnerability exists in Oracle Process Manufacturing Process Planning (component: Internal Operations) versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is included in Oracle's June 2026 Critical Security Patch Update advisory. Oracle strongly urges customers to apply the patch immediately. No explicit patch version is stated in the provided data, but the advisory references the Critical Security Patch Update as the remediation method. Workarounds include blocking network protocols required for exploitation and removing unnecessary privileges, though these may affect application functionality.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Process Manufacturing Process Planning, impacting confidentiality, integrity, and availability of the system. This can lead to complete takeover of the affected product component.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply this patch without delay. Until the patch is applied, risk can be partially mitigated by blocking network protocols required for the attack and removing unnecessary privileges from users, though these measures may disrupt normal application operations. Patch status is not explicitly confirmed in the advisory text but applying the June 2026 Critical Security Patch Update is the recommended remediation.