This vulnerability affects the Oracle Order Management product within Oracle E-Business Suite, specifically versions 12.2.4 to 12.2.15. It permits a low-privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Order Management. The CVSS 3.1 base score is 8.1, indicating high severity with high confidentiality and integrity impacts and no impact on availability. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability, advising customers to apply available patches without delay.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Order Management, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not impact availability.

The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability. Customers are strongly advised to apply the latest Oracle Critical Patch Updates promptly, as these updates cumulatively address multiple vulnerabilities. Monitor the Oracle Critical Patch Update advisory for specific patch availability and installation instructions related to Oracle Order Management versions 12.2.4 through 12.2.15.