This vulnerability affects Oracle Advanced Supply Chain Planning versions 12.2.3 through 12.2.15. It is exploitable by a high privileged attacker with network access via HTTP and can lead to complete compromise of the affected product. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published this issue as part of its July 2026 Critical Patch Update, which includes security patches addressing this and other vulnerabilities. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation allows an attacker with high privileges and network access to take over Oracle Advanced Supply Chain Planning, impacting confidentiality, integrity, and availability of the system. This could lead to unauthorized access, data manipulation, and service disruption within the affected product environment.

Oracle has released security patches for this vulnerability as part of the July 2026 Critical Patch Update. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Oracle emphasizes the importance of staying on actively-supported versions and applying security patches without delay to mitigate exploitation risks.