This vulnerability affects Oracle Process Manufacturing Systems within Oracle E-Business Suite (component: Internal Operations) in versions 12.2.11 to 12.2.15. It is easily exploitable by an attacker with high privileges and network access over HTTP, enabling compromise of the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly state a patch for this specific vulnerability. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function).

Successful exploitation can lead to complete compromise of Oracle Process Manufacturing Systems, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected system, potentially disrupting business operations and exposing sensitive data.

Oracle's July 2026 Critical Patch Update advisory should be reviewed for patch availability and installation instructions. As the advisory does not explicitly confirm a patch for this vulnerability, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions to mitigate exploitation risks.