This vulnerability affects Oracle Order Management versions 12.2.3 through 12.2.15 and involves the Product Diagnostic Tools component. It allows an attacker with low privileges and network access via HTTP to compromise the system without requiring user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is associated with CWE-306 (Missing Authentication), CWE-287 (Improper Authentication), CWE-269 (Improper Privilege Management), and CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a patch or remediation level for this vulnerability. Patch status is therefore not yet confirmed and should be verified with Oracle's advisory.

Successful exploitation can lead to complete compromise of Oracle Order Management, allowing an attacker to gain unauthorized control over the system. This includes full confidentiality, integrity, and availability impacts, potentially leading to data breaches, unauthorized modifications, and service disruptions.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Order Management HTTP interfaces to trusted users only and monitor for suspicious activity related to this component.