This vulnerability affects Oracle Product Workbench within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It is an easily exploitable issue that allows an attacker with low privileges and network access via HTTP to gain unauthorized access to critical data, including the ability to create, delete, or modify such data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-284 (Improper Access Control). The vendor advisory from Oracle references a July 2026 Critical Patch Update containing many patches but does not explicitly confirm a patch for this specific vulnerability. Patch status is therefore not yet confirmed and should be verified with Oracle's advisory.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Workbench, as well as unauthorized access to all accessible data in the product. This compromises the confidentiality and integrity of the data but does not impact availability. The vulnerability can be exploited remotely over the network with low privileges and no user interaction required.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Product Workbench to trusted users only and monitor for unusual activity related to the product.