This vulnerability affects Oracle Work in Process within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It requires an attacker with low privileges and logon access to the infrastructure where Oracle Work in Process runs. Exploitation can result in unauthorized read access to a subset of accessible data and partial denial of service conditions. The CVSS 3.1 vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, no integrity impact, and low availability impact. The vendor advisory does not explicitly confirm a patch or remediation status but references the July 2026 Critical Patch Update advisory page for patch information.

The impact includes unauthorized read access to some Oracle Work in Process data and the ability to cause a partial denial of service. The confidentiality and availability impacts are limited, with no integrity impact. The vulnerability requires local access with low privileges and is difficult to exploit, reducing the overall risk.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is applied, restrict access to the infrastructure hosting Oracle Work in Process to trusted users only.