This vulnerability affects Oracle Production Scheduling version 12.2.3 and permits a low privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data, unauthorized read access to some data, and partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact. The vendor advisory from Oracle's July 2026 Critical Patch Update does not explicitly confirm a patch or remediation level for this specific vulnerability but emphasizes the importance of applying available security patches without delay. The vulnerability is listed as affecting exactly version 12.2.3. There are no known exploits in the wild currently.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized ability to create, delete, or modify critical data or all accessible data within Oracle Production Scheduling. They can also read some data without authorization and cause a partial denial of service. This impacts confidentiality, integrity, and availability of the affected system, with integrity impact rated high and confidentiality and availability impacts rated low according to CVSS 3.1.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively-supported versions and apply security patches promptly as part of their Critical Patch Update program. Until an official patch is confirmed and applied, restrict network access to Oracle Production Scheduling where possible and monitor for unusual activity related to this product.