This vulnerability affects Oracle Process Manufacturing Regulatory Management component of Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access via HTTP to gain unauthorized access that can result in creation, deletion, or modification of critical data within the product. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality and integrity. The vulnerability is classified under CWE-284 (Improper Access Control). The vendor advisory linked does not explicitly confirm patch availability or remediation status for this specific vulnerability as of the advisory date.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Process Manufacturing Regulatory Management. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability is exploitable remotely over the network with low attack complexity and requires low privileges, increasing risk.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to the affected service and monitor for unusual activity related to Oracle Process Manufacturing Regulatory Management.