This vulnerability in Oracle Production Scheduling (component of Oracle E-Business Suite) allows a low privileged attacker with network access over HTTP to compromise the product and gain unauthorized access to critical or all accessible data. The vulnerability affects versions from 12.2.3 up to and including 12.2.15. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. Oracle has published this vulnerability as part of its August 2026 Critical Security Patch Update advisory, which addresses this and many other vulnerabilities. Oracle strongly recommends applying the available patches promptly to mitigate this risk.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Production Scheduling. This compromises confidentiality but does not affect integrity or availability. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit if the system is exposed and unpatched.

Oracle has released patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant security patches without delay to remediate this issue. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to prevent exploitation. No additional vendor mitigation instructions indicate that no other immediate actions are required beyond patching.