This vulnerability affects Oracle Product Workbench component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical or all accessible data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch for this vulnerability. Customers are urged to apply available patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via Oracle Product Workbench. Confidentiality and integrity of data are severely impacted. There is no impact on availability. This could compromise the integrity and confidentiality of business-critical information managed by Oracle Product Workbench.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. Although the advisory does not explicitly confirm a patch for CVE-2026-47014, customers should review the advisory and apply all relevant patches promptly to mitigate this vulnerability. Until explicit patch information is confirmed, organizations should prioritize patching and follow Oracle's security recommendations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance: https://www.oracle.com/security-alerts/cpujul2026.html