This vulnerability affects Oracle Production Scheduling versions 12.2.3 to 12.2.15 and involves improper access control (CWE-284) in the component Internal Operations. An attacker with high privileges and network access via HTTP can exploit this vulnerability to gain unauthorized capabilities, including creating, deleting, or modifying critical data and reading some data within Oracle Production Scheduling. The vulnerability has a CVSS 3.1 vector of AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N, reflecting network attack vector, high attack complexity, required high privileges, no user interaction, scope change, low confidentiality impact, high integrity impact, and no availability impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches across Oracle products.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Production Scheduling, as well as unauthorized read access to a subset of that data. The vulnerability may also affect additional Oracle products due to scope change. The CVSS score of 6.6 indicates a medium severity impact primarily on confidentiality and integrity, with no impact on availability.

The Oracle advisory for the July 2026 Critical Patch Update includes security patches addressing this vulnerability. However, explicit patch availability or remediation level for this specific vulnerability is not confirmed in the advisory content provided. Oracle strongly recommends applying the latest Critical Patch Update promptly to mitigate this and other vulnerabilities. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.