This vulnerability affects Oracle MES for Process Manufacturing versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all accessible data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without affecting integrity or availability. The vulnerability may also impact other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized access to critical or all accessible data in Oracle MES for Process Manufacturing. The vulnerability has a high confidentiality impact but does not affect integrity or availability. The scope change indicates potential impact on additional Oracle products beyond MES for Process Manufacturing.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the relevant security patches from this update promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed as available via Oracle's official advisory.