This vulnerability affects Oracle Production Scheduling versions 12.2.3 through 12.2.15. It permits an unauthenticated attacker with network access over HTTP to compromise the product, potentially resulting in unauthorized access to critical or complete accessible data. Successful exploitation requires user interaction from a third party. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. No official remediation level or patch information is provided in the advisory, but Oracle recommends applying Critical Patch Updates promptly. The vendor advisory URL is https://www.oracle.com/security-alerts/cpujul2026.html.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Oracle Production Scheduling. There is no reported impact on data integrity or availability. The vulnerability requires user interaction and has high attack complexity, limiting ease of exploitation. No known exploits are reported in the wild at this time.

Oracle has not explicitly stated a patch or remediation level for this specific vulnerability in the provided advisory. However, Oracle strongly recommends that customers remain on actively supported versions and apply Critical Patch Updates without delay. Users of Oracle Production Scheduling versions 12.2.3 through 12.2.15 should monitor Oracle's Critical Patch Update advisories and apply relevant patches promptly once available. Until patched, limiting network exposure of Oracle Production Scheduling and educating users to avoid interacting with suspicious content may reduce risk.