This vulnerability exists in the Internal Operations component of Oracle Warehouse Management within Oracle E-Business Suite. It is exploitable remotely over HTTP by unauthenticated attackers, enabling unauthorized access to sensitive data. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network attack vector, low attack complexity, no privileges or user interaction required, and a high confidentiality impact with no integrity or availability impact. Affected versions are from 12.2.3 up to and including 12.2.15. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory but no direct patch link was provided in the input data.

Successful exploitation allows an unauthenticated attacker to access critical or all data accessible by Oracle Warehouse Management, potentially leading to data confidentiality breaches. There is no reported impact on data integrity or availability. The vulnerability is considered high severity due to the ease of exploitation and the sensitivity of the data at risk.

Oracle strongly recommends applying the security patches included in the August 2026 Critical Security Patch Update. Customers should remain on actively-supported versions and promptly apply available patches to mitigate this vulnerability. Since this is not a cloud service, remediation depends on customer patching. Patch status is not explicitly confirmed in the provided data; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions.