This vulnerability affects Oracle Process Manufacturing Systems within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is an easily exploitable flaw allowing an attacker with low privileges and network access via HTTP to gain unauthorized access to critical data, including the ability to create, delete, or modify such data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts without affecting availability. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch for this vulnerability but recommends applying security patches promptly. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Process Manufacturing Systems. Confidentiality and integrity of all accessible data in the affected systems can be compromised. Availability is not impacted. This could result in significant data breaches or data integrity issues within affected Oracle E-Business Suite environments.

Patch status is not yet confirmed—check the Oracle July 2026 Critical Patch Update advisory and subsequent updates for current remediation guidance. Oracle strongly recommends applying security patches without delay once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Process Manufacturing Systems and monitor for unusual activity consistent with unauthorized data access attempts.