This vulnerability affects Oracle Product Workbench within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to gain unauthorized access that can result in creation, deletion, or modification of critical data accessible through Oracle Product Workbench. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts and no impact on availability. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which includes numerous patches across multiple products, but the advisory content provided does not explicitly confirm a patch for this vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Workbench, as well as unauthorized access to all data accessible by the product. This compromises the confidentiality and integrity of the data but does not impact system availability.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Product Workbench interfaces to trusted users only.