This vulnerability affects Oracle Production Scheduling versions 12.2.3 through 12.2.15 and allows an attacker with low privileges and network access via HTTP to compromise the product. The attacker can gain unauthorized capabilities including creating, deleting, or modifying critical data, reading some data without authorization, and causing a partial denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact. Oracle's July 2026 Critical Patch Update advisory references many vulnerabilities but does not explicitly confirm a patch or remediation for this specific CVE. Customers are urged to apply available patches promptly, but patch status for this vulnerability is not yet confirmed.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data within Oracle Production Scheduling, unauthorized read access to some data, and partial denial of service. This impacts confidentiality, integrity, and availability of the affected system. The CVSS score of 7.6 reflects a high severity with significant integrity impact and moderate confidentiality and availability impacts.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, limit network access to Oracle Production Scheduling and monitor for suspicious activity consistent with the vulnerability's attack vector.