This vulnerability affects Oracle Production Scheduling versions 12.2.3 to 12.2.15 and involves improper access control (CWE-284) that could allow a high privileged attacker with existing logon access to the infrastructure to modify data within the application. The CVSS 3.1 base score is 1.9 with vector AV:L/AC:H/PR:H/UI:N, indicating local attack vector, high attack complexity, required high privileges, no user interaction, and limited impact on integrity only. The vendor advisory does not explicitly confirm a patch or fix for this issue as of the July 2026 Critical Patch Update advisory.

Successful exploitation could lead to unauthorized update, insert, or delete access to some data accessible by Oracle Production Scheduling, impacting data integrity. There is no impact on confidentiality or availability reported. The vulnerability requires high privileges and local access, making exploitation difficult.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly when available and remaining on actively supported versions. Since no specific patch or temporary fix is currently documented, monitor Oracle advisories for updates.