This vulnerability affects Oracle Work in Process within Oracle E-Business Suite versions 12.2.14 and 12.2.15. It is easily exploitable by an attacker with low privileges and network access over HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Work in Process. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. The vulnerability is classified under CWE-284 (Improper Access Control). The vendor advisory does not explicitly confirm a patch or remediation level for this specific vulnerability but references the July 2026 Critical Patch Update advisory, which includes many patches across Oracle products.

The vulnerability allows unauthorized access to critical data within Oracle Work in Process, including the ability to create, delete, or modify data. This compromises the confidentiality and integrity of the affected system's data. There is no reported impact on system availability. No known exploits in the wild have been reported at the time of publication.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Work in Process HTTP interfaces to trusted users only.