This vulnerability affects Oracle Order Management versions 12.2.3 to 12.2.15 and involves an easily exploitable flaw that permits a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation results in unauthorized access to critical or all accessible data within Oracle Order Management. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vulnerability is categorized under CWE-200 (Exposure of Sensitive Information) and CWE-284 (Improper Access Control). The vendor advisory from Oracle's July 2026 Critical Patch Update references this vulnerability but does not explicitly confirm patch availability or remediation status for Oracle Order Management. Oracle strongly recommends applying security patches promptly, but no direct patch link or fix confirmation is provided in the advisory for this specific vulnerability.

Exploitation of this vulnerability can lead to unauthorized access to sensitive or critical data within Oracle Order Management. There is no indication of impact on data integrity or system availability. The vulnerability allows an attacker with low privileges and network access to gain elevated data access, potentially compromising confidentiality of business-critical information.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle's advisory strongly recommends applying security patches without delay for all supported products. Until a patch is confirmed and applied, restrict network access to Oracle Order Management HTTP interfaces to trusted users only and monitor for unusual access patterns. Follow Oracle's security update instructions once patches become available.