This vulnerability affects Oracle Work in Process versions 12.2.3 to 12.2.15 and involves unauthorized read access to a subset of data accessible by the product. Exploitation requires a high privileged attacker who already has logon access to the infrastructure hosting Oracle Work in Process. The CVSS 3.1 base score is 1.9, reflecting low confidentiality impact and no impact on integrity or availability. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information). No official remediation level or patch is explicitly stated in the vendor advisory, but Oracle strongly recommends applying Critical Patch Updates promptly. The vendor advisory linked is a general Critical Patch Update advisory for July 2026 and does not specifically confirm a patch for this vulnerability.

Successful exploitation can result in unauthorized read access to a subset of Oracle Work in Process accessible data. There is no impact on data integrity or availability. The vulnerability requires high privileges and local access to the infrastructure, making exploitation difficult.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle recommends staying on actively supported versions and applying Critical Patch Updates without delay. Since no specific patch or workaround is explicitly mentioned for this vulnerability in the advisory, organizations should monitor Oracle's security alerts and apply updates as they become available.