This vulnerability affects Oracle Work in Process versions 12.2.3 through 12.2.15 and allows a high privileged attacker with existing logon access to the infrastructure to compromise Oracle Work in Process. The impact is limited to unauthorized read access to some data within Oracle Work in Process. The CVSS 3.1 base score is 1.9, reflecting low confidentiality impact and no impact on integrity or availability. The attack vector is local with high attack complexity and requires high privileges. Oracle has published a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities including this one, but no explicit patch or remediation level is stated for this specific vulnerability in the provided advisory content.

The vulnerability allows unauthorized read access to a subset of data accessible by Oracle Work in Process. There is no impact on data integrity or system availability. Exploitation requires high privileges and local access to the infrastructure, making it difficult to exploit. The confidentiality impact is low.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying available security patches promptly. Since no explicit patch or remediation level is stated for this vulnerability, monitoring Oracle advisories for updates is advised. No vendor advisory states that no action is required or that the issue is already mitigated.