This vulnerability affects Oracle MES for Process Manufacturing versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit the vulnerability, but successful attacks require user interaction from someone other than the attacker. The vulnerability impacts confidentiality and integrity, potentially allowing unauthorized access to critical data and unauthorized data modification within Oracle MES for Process Manufacturing. The scope of impact may extend to additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, with a base score of 8.2. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability and strongly recommends applying patches promptly.

Exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on some data within Oracle MES for Process Manufacturing. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires network access and user interaction from a person other than the attacker. The vulnerability may also affect other Oracle products due to scope change.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly and remain on actively supported versions. No indication is given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, patching must be applied by customers according to Oracle's advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.