This vulnerability affects Oracle Warehouse Management within Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the product, potentially resulting in complete system takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not provide explicit patch or remediation details for it. No known exploits in the wild have been reported.

Successful exploitation can lead to full compromise of Oracle Warehouse Management, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected system, potentially disrupting warehouse operations and exposing sensitive data.

Oracle has included this vulnerability in their July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or remediation for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply any relevant patches promptly. Until explicit patch information is confirmed, monitor Oracle's advisories for updates. No alternative mitigations are specified by the vendor.