This vulnerability affects Oracle Flow Manufacturing component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product by leveraging a flaw that requires user interaction (UI:R) and results in unauthorized update, insert, delete, and read access to some data. The vulnerability has a scope change, meaning exploitation may affect other Oracle products beyond Flow Manufacturing. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts.

Exploitation can lead to unauthorized modification (update, insert, delete) and partial unauthorized reading of data within Oracle Flow Manufacturing. The scope change indicates that other Oracle products integrated or related to Flow Manufacturing may also be impacted. There is no impact on availability. The vulnerability requires user interaction and low privileges, which somewhat limits exploitation but still poses a risk to data integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying Critical Patch Updates promptly to address vulnerabilities. Until a patch is applied, limit network access to Oracle Flow Manufacturing and educate users to avoid interacting with untrusted content that could trigger exploitation.