This vulnerability affects Oracle Flow Manufacturing versions 12.2.13 through 12.2.15 and enables a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Flow Manufacturing. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. The vendor advisory references a July 2026 Critical Patch Update containing numerous security patches but does not explicitly confirm a patch for this specific vulnerability. Patch status is therefore not yet confirmed and should be verified by consulting the vendor advisory directly.

The vulnerability allows unauthorized creation, deletion, or modification of critical data within Oracle Flow Manufacturing, potentially compromising the confidentiality and integrity of all accessible data. There is no impact on availability. This could lead to significant data breaches or data manipulation within affected environments.

Patch status is not yet confirmed—check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Flow Manufacturing interfaces to trusted users only and monitor for suspicious activity related to data modification.