This vulnerability in Oracle Work in Process (component of Oracle E-Business Suite) allows unauthenticated remote attackers to compromise the system via HTTP network access. Affected versions include 12.2.3 through 12.2.15. The vulnerability is rated critical with a CVSS 3.1 score of 9.8, reflecting complete compromise potential (confidentiality, integrity, availability). The vendor has released a Critical Patch Update in July 2026 addressing numerous vulnerabilities across Oracle products, including this one. However, the vendor advisory does not explicitly confirm the availability of a specific patch or fix for this vulnerability. Customers are strongly advised to apply Oracle Critical Patch Updates promptly to mitigate risks.

Successful exploitation can lead to full takeover of Oracle Work in Process, impacting confidentiality, integrity, and availability of the affected system. This enables an unauthenticated attacker to gain complete control over the component, potentially leading to severe operational and data security consequences.

Oracle has released a Critical Patch Update advisory in July 2026 that includes security patches for multiple vulnerabilities. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches without delay. Patch status for this specific vulnerability is not explicitly confirmed in the advisory content provided; therefore, customers should verify patch availability and applicability from Oracle's official resources. Maintaining up-to-date patching is the primary mitigation. No vendor advisory states that no action is required or that the vulnerability is already mitigated.