This vulnerability exists in the Internal Operations component of Oracle Process Manufacturing Regulatory Management version 12.2.3. It is easily exploitable by an attacker with network access via HTTP and low privileges. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by the product, as well as unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 score of 8.5 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. The Oracle Critical Patch Update advisory from July 2026 references many patches but does not explicitly confirm a patch for this specific vulnerability. The vendor strongly recommends applying available patches promptly to mitigate exploitation risks.

Exploitation of this vulnerability can result in unauthorized access to sensitive and critical data within Oracle Process Manufacturing Regulatory Management. Attackers may gain complete access to all accessible data and have the ability to modify (update, insert, delete) some data, impacting confidentiality and integrity. There is no reported impact on availability. The vulnerability also has scope change implications, potentially affecting additional Oracle products beyond the initially targeted component.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends customers remain on actively supported versions and apply security patches without delay. Until a patch is confirmed and applied, restrict network access to Oracle Process Manufacturing Regulatory Management instances to trusted users only and monitor for unusual activity related to this product.