This vulnerability affects Oracle Flow Manufacturing versions 12.2.13 through 12.2.15 and permits a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Flow Manufacturing. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch for this specific vulnerability, recommending customers apply patches without delay. No known exploits have been reported in the wild.

An attacker with low privileges and network access via HTTP can gain unauthorized ability to create, delete, or modify critical data or all data accessible in Oracle Flow Manufacturing. This compromises the confidentiality and integrity of the affected system's data, potentially leading to significant operational and data trust issues. There is no reported impact on availability. No known exploits in the wild have been reported to date.

The vendor advisory does not explicitly confirm a patch for this vulnerability but strongly recommends applying Oracle Critical Patch Updates promptly to mitigate known vulnerabilities. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for patch availability and installation instructions. Until a patch is applied, restrict network access to Oracle Flow Manufacturing interfaces to trusted users only and monitor for unusual activity. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.