This vulnerability in Oracle Warehouse Management (component: Internal Operations) allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all accessible data within Oracle Warehouse Management. Additionally, it can result in unauthorized access to critical or all accessible data and cause a partial denial of service. The affected versions are from 12.2.3 up to and including 12.2.15. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with low availability impact.

The vulnerability allows attackers with low privileges and network access to fully compromise Oracle Warehouse Management data integrity and confidentiality, including unauthorized creation, deletion, or modification of critical data. It also enables unauthorized access to all accessible data and can cause a partial denial of service, impacting availability. This could disrupt business operations relying on Oracle Warehouse Management.

Oracle has released security patches addressing this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions (12.2.3 through 12.2.15). Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.