This vulnerability affects Oracle Work in Process versions 12.2.3 to 12.2.15 and involves internal operations. An attacker with low privileges who can log on to the infrastructure where Oracle Work in Process runs may exploit this issue to read unauthorized data subsets and cause a partial denial of service. The CVSS 3.1 vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for it. The advisory strongly recommends applying patches promptly but does not specify a fix for this particular issue.

Successful exploitation can lead to unauthorized read access to a subset of data accessible by Oracle Work in Process and the ability to cause a partial denial of service affecting availability. The impact on confidentiality and availability is low, with no impact on integrity. The attack requires local access with low privileges and is difficult to exploit.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance. Oracle recommends staying on actively supported versions and applying security patches without delay. Until an official fix is confirmed, restrict access to the infrastructure hosting Oracle Work in Process to trusted users only.