This vulnerability affects Oracle Production Scheduling versions 12.2.3 to 12.2.15 and involves internal operations. It requires a high privileged attacker with network access via HTTP and no user interaction. The vulnerability can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to a subset of data. The scope of impact may extend beyond Oracle Production Scheduling to other Oracle products. The CVSS vector is AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, scope change, low confidentiality impact, high integrity impact, and no availability impact. No official patch or remediation level is specified in the advisory, but Oracle's July 2026 Critical Patch Update advisory references security patches for multiple products and strongly recommends applying patches promptly.

Successful exploitation allows a high privileged attacker with network access to perform unauthorized creation, deletion, or modification of critical data within Oracle Production Scheduling, as well as unauthorized read access to some data. The vulnerability may also affect additional Oracle products due to scope change. The confidentiality impact is low, integrity impact is high, and availability is not affected. The overall severity is medium (CVSS 6.6).

Oracle's July 2026 Critical Patch Update advisory recommends applying the latest security patches promptly. Although no specific patch or remediation level for this vulnerability is explicitly stated, Oracle strongly advises customers to remain on actively supported versions and apply security patches without delay. Users of Oracle Production Scheduling versions 12.2.3 through 12.2.15 should consult the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions.