This vulnerability affects Oracle Flow Manufacturing component of Oracle E-Business Suite in versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access over HTTP to compromise the product by gaining unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. Exploitation requires human interaction from a user other than the attacker. The vulnerability has a CVSS 3.1 score of 5.4 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope change, and low confidentiality and integrity impacts.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and partial unauthorized reading of Oracle Flow Manufacturing accessible data. The vulnerability may also affect additional Oracle products due to scope change. There is no impact on availability. The medium CVSS score reflects moderate confidentiality and integrity risks.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly as part of their Critical Patch Update process. Until a patch is confirmed and applied, organizations should be aware that exploitation requires user interaction and low privileges but can lead to unauthorized data modification and reading. No specific temporary mitigations are provided in the advisory.