This vulnerability in Oracle Work in Process (component of Oracle E-Business Suite) affects supported versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access over HTTP to compromise the product, resulting in unauthorized access to sensitive or all accessible data within Oracle Work in Process. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability. Oracle emphasizes the importance of applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized access to critical or all accessible data in Oracle Work in Process. The confidentiality of sensitive information is at risk, but integrity and availability are not impacted. The vulnerability requires network access and is difficult to exploit, limiting the attacker's capabilities to some extent. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches promptly to mitigate this and other vulnerabilities. No specific temporary mitigations are provided in the advisory.