This vulnerability affects Oracle Process Manufacturing Product Development component of Oracle E-Business Suite, specifically version 12.2.15. It is easily exploitable by an attacker with low privileges who can access the system over HTTP. Successful exploitation can lead to complete compromise of the affected product, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability for this specific version or vulnerability. Customers are strongly advised to apply available patches promptly.

An attacker with network access and low privileges can exploit this vulnerability to fully compromise Oracle Process Manufacturing Product Development version 12.2.15. This results in complete loss of confidentiality, integrity, and availability of the affected product, potentially allowing takeover and unauthorized control.

Oracle has released a Critical Patch Update advisory in July 2026 addressing numerous vulnerabilities across its product portfolio. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches for Oracle Process Manufacturing Product Development version 12.2.15 without delay. Patch status for this specific vulnerability is not explicitly confirmed; therefore, customers must verify patch availability and installation instructions in the vendor advisory. Maintaining up-to-date patched versions is critical to mitigate this vulnerability.