This vulnerability affects Oracle MES for Process Manufacturing within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. The vulnerability can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some accessible data. The scope of impact may extend beyond the MES product to other Oracle products. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. No official patch or remediation level is explicitly stated in the advisory, and no known exploits in the wild have been reported. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability.

Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data within Oracle MES for Process Manufacturing. The vulnerability may also affect additional Oracle products due to scope change. This can compromise confidentiality and integrity of data accessible through the affected product versions.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until an official patch is confirmed and applied, limit network exposure of Oracle MES for Process Manufacturing and educate users to avoid interaction with untrusted content that could trigger exploitation.