This vulnerability affects Oracle Order Management versions 12.2.3 through 12.2.15 and involves a flaw in the Product Diagnostic Tools component. An attacker with high privileges and network access via HTTP can exploit this vulnerability to compromise the system, leading to full takeover of Oracle Order Management. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this and other vulnerabilities. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Order Management, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected product, potentially leading to unauthorized access, data manipulation, and service disruption.

Oracle has released security patches as part of the July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html). Customers using affected versions (12.2.3 through 12.2.15) should apply these patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability. Patch status is confirmed by the vendor advisory indicating that patches are available.