This vulnerability affects Oracle Warehouse Management component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in complete takeover. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. The vulnerability is related to weaknesses identified by CWEs 306 (Missing Authentication for Critical Function), 287 (Improper Authentication), 269 (Improper Privilege Management), and 284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for Oracle Warehouse Management. Customers are advised to consult the advisory for patch information and apply updates promptly.

Successful exploitation can lead to full compromise of Oracle Warehouse Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access and control over warehouse management operations.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities across Oracle products, including Oracle Warehouse Management. However, the advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability. Customers should review the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches without delay. Until patches are applied, restrict network access to Oracle Warehouse Management and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.