This vulnerability affects Oracle Order Management component Product Diagnostic Tools in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits an attacker with low privileges and network access over HTTP to compromise the system, resulting in unauthorized access to sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others and provides patch availability information.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Order Management. There is no reported impact on data integrity or system availability. The vulnerability requires network access via HTTP and low privileges, making it moderately exploitable. No known exploits in the wild have been reported at this time.

Oracle has released security patches as part of the July 2026 Critical Patch Update advisory. Customers are strongly advised to apply these patches promptly to remediate this vulnerability. The vendor advisory does not indicate that the vulnerability is already mitigated or requires no action. Patch status is confirmed by the vendor advisory; therefore, applying the official Oracle patches is the recommended mitigation.