This vulnerability in Oracle Flow Manufacturing (component: Internal Operations) affects supported versions 12.2.7 to 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory mentions multiple patches across products but does not explicitly confirm a patch for this specific vulnerability or version. The advisory emphasizes applying patches promptly but does not provide direct remediation details for Oracle Flow Manufacturing 12.2.7.

The vulnerability allows an attacker with low privileges and network access to fully compromise Oracle Flow Manufacturing, leading to complete takeover. This impacts confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Oracle has released a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities. However, the advisory content provided does not explicitly confirm a patch or official fix for Oracle Flow Manufacturing versions 12.2.7 through 12.2.15. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying available security patches promptly and remaining on actively supported versions.