This vulnerability affects Oracle Production Scheduling component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker who has logon access to the infrastructure where the product executes to compromise Oracle Production Scheduling. Exploitation requires user interaction from a person other than the attacker, and successful attacks may impact additional Oracle products beyond Production Scheduling (scope change). The impact includes unauthorized creation, deletion, or modification of critical data and unauthorized read access to some data. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N, with a base score of 6.7. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for it. Customers are advised to review the advisory and apply patches as recommended.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Production Scheduling, as well as unauthorized read access to a subset of accessible data. The vulnerability affects confidentiality and integrity, with no impact on availability. The scope change indicates that other Oracle products may also be affected indirectly. The CVSS score of 6.7 reflects a medium severity risk.

Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for it. Customers should consult the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant updates promptly. Until a patch is applied, limiting logon access to the infrastructure where Oracle Production Scheduling executes and minimizing opportunities for required user interaction may reduce risk. Monitor Oracle’s advisories for updates on remediation.