This vulnerability in Oracle Flow Manufacturing (component: Internal Operations) affects supported versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible through Oracle Flow Manufacturing, as well as unauthorized modification capabilities (update, insert, delete) on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

The vulnerability allows unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data within Oracle Flow Manufacturing. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is rated high severity with a CVSS score of 7.1.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.