This vulnerability affects Oracle Process Manufacturing Process Execution component of Oracle E-Business Suite, specifically version 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is described as difficult to exploit. Oracle's July 2026 Critical Patch Update advisory references multiple patches across many products but does not explicitly confirm a patch or remediation for this CVE. The vendor strongly recommends applying patches promptly for supported versions.

Successful exploitation can result in complete compromise of Oracle Process Manufacturing Process Execution, affecting confidentiality, integrity, and availability of the system. The attacker requires only low privileges and network access via HTTP, though the attack complexity is high. This could allow unauthorized control over the affected product.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends customers remain on actively-supported versions and apply security patches without delay. Until an official patch is confirmed and applied, monitor Oracle advisories for updates.