This vulnerability affects Oracle Process Manufacturing Inventory component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle’s July 2026 Critical Patch Update advisory references many patches but does not explicitly confirm a fix for this vulnerability. Patch status is therefore not yet confirmed and should be verified with Oracle’s advisory.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Process Manufacturing Inventory. This compromises confidentiality and integrity of the data, potentially leading to significant business impact. The vulnerability does not impact availability. The attack requires network access via HTTP and low privileges, making it relatively easy to exploit.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Process Manufacturing Inventory interfaces to trusted users only and monitor for suspicious activity related to unauthorized data modifications.