This vulnerability affects Oracle Process Manufacturing Logistics versions 12.2.3 through 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical or all accessible data and unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches across products but does not explicitly confirm the patch status for this vulnerability. No known exploits in the wild are reported.

Exploitation of this vulnerability can result in unauthorized access to critical or all data accessible by Oracle Process Manufacturing Logistics, as well as unauthorized modification of some data. This compromises confidentiality and integrity of the affected system's data, potentially leading to data breaches or unauthorized data manipulation. There is no reported impact on availability. The vulnerability requires network access and low privileges but no user interaction.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses numerous vulnerabilities across Oracle products. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Since no explicit patch or remediation level is stated for this specific vulnerability in the provided data, patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, restrict network access to Oracle Process Manufacturing Logistics and monitor for unusual activity related to data access or modification.