This vulnerability affects Oracle Production Scheduling versions 12.2.3 through 12.2.15. It permits a high privileged attacker with network access via HTTP to compromise the product by gaining unauthorized capabilities to update, insert, or delete certain accessible data, read some data without authorization, and cause a partial denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. The vulnerability is classified under CWE-284 (Improper Access Control). The official Oracle advisory does not explicitly confirm patch availability or remediation status for this specific vulnerability but references a July 2026 Critical Patch Update containing many patches. No known exploits in the wild have been reported.

Successful exploitation allows unauthorized update, insert, or delete access to some Oracle Production Scheduling accessible data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service. The impact on confidentiality, integrity, and availability is rated low but still significant for affected data and service availability. The attack requires high privileges and network access via HTTP.

Patch status is not yet confirmed—check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and staying on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory.