This vulnerability exists in the User Interface component of Oracle Production Scheduling versions 12.2.3 to 12.2.15. It can be exploited remotely over the network via HTTP by an attacker with low privileges. The vulnerability allows unauthorized access to sensitive data within the affected product, compromising confidentiality without impacting integrity or availability. The CVSS vector indicates a network attack vector requiring high attack complexity and low privileges, with no user interaction needed. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Production Scheduling, resulting in a confidentiality breach. There is no indication of impact to data integrity or system availability. The vulnerability is considered difficult to exploit and requires network access and low privileges.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. No specific workaround or temporary fix is documented in the advisory for this vulnerability at this time.