This vulnerability affects Oracle Bills of Material versions 12.2.13 to 12.2.15 and enables a low-privileged attacker with network access over HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, resulting in full access to all data accessible by Oracle Bills of Material. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no availability impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches across Oracle products, but the specific patch status for this vulnerability is not explicitly confirmed in the advisory excerpt provided.

The vulnerability allows unauthorized access to critical data within Oracle Bills of Material, including the ability to create, delete, or modify data. This compromises the confidentiality and integrity of the affected system's data, potentially leading to significant operational and business risks. There is no reported impact on system availability. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Since the vendor advisory does not explicitly confirm patch availability or remediation level for this specific vulnerability, patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Maintaining supported versions and timely application of Oracle patches is recommended to mitigate this vulnerability.