This vulnerability in Oracle Production Scheduling allows a low privileged attacker with network access over HTTP to potentially compromise the system and gain unauthorized access to sensitive data. The vulnerability affects Oracle E-Business Suite versions 12.2.3 through 12.2.15. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. Oracle's July 2026 Critical Patch Update advisory references multiple vulnerabilities but does not explicitly confirm a patch or remediation for this specific issue. Customers are advised to apply available patches promptly, but patch status for this vulnerability is not explicitly confirmed.

Successful exploitation can result in unauthorized access to critical or all accessible data within Oracle Production Scheduling. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability requires network access and is difficult to exploit, with a medium overall severity rating.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle recommends applying security patches promptly and remaining on actively supported versions. No specific temporary mitigations or workarounds are provided in the advisory content.