This vulnerability in Oracle Order Management (component: Product Diagnostic Tools) affects supported versions 12.2.3 through 12.2.15. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the product. The vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's advisory for the August 2026 Critical Security Patch Update includes fixes for this vulnerability, emphasizing the importance of applying patches without delay.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data within Oracle Order Management and unauthorized modification of some data. The scope of impact may extend to additional Oracle products due to the nature of the vulnerability. The CVSS score of 7.1 indicates a high severity with significant confidentiality and integrity impacts but no availability impact. There are no known exploits in the wild at this time.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches promptly to mitigate the risk. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No additional mitigations are specified beyond patching.