This vulnerability affects Oracle Process Manufacturing Regulatory Management versions 12.2.3 through 12.2.15 and permits a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle's July 2026 Critical Patch Update advisory references a large set of patches but does not explicitly confirm patch availability or remediation status for this vulnerability. Users are strongly advised to consult the vendor advisory for the latest patch information.

The vulnerability allows unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Process Manufacturing Regulatory Management. This compromises confidentiality and integrity of sensitive data within the affected product. There is no reported impact on availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is applied, restrict network access to the affected service to trusted users only.