This vulnerability affects Oracle Bills of Material versions 12.2.3 to 12.2.15 and involves a flaw in the Internal Operations component. An attacker with low privileges and network access via HTTP can exploit this vulnerability, but successful exploitation requires user interaction from a third party. The impact includes complete compromise of the Oracle Bills of Material product. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references a Critical Patch Update released in July 2026 covering multiple products, including Oracle Bills of Material, but does not explicitly confirm patch availability or remediation status for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can result in full takeover of Oracle Bills of Material, impacting confidentiality, integrity, and availability of the product. The vulnerability allows an attacker with low privileges and network access to compromise the system, but requires user interaction from a person other than the attacker. This could lead to unauthorized access, data manipulation, and service disruption within Oracle Bills of Material.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a fix for this vulnerability. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Until an official patch or workaround is confirmed, organizations should monitor Oracle's security advisories and apply updates as they become available.