This vulnerability in Oracle Process Manufacturing Systems (component: Internal Operations) allows an attacker with low privileges and network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Process Manufacturing Systems. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Affected versions are 12.2.3 through 12.2.15. Oracle has addressed this vulnerability in their August 2026 Critical Security Patch Update.

The vulnerability enables unauthorized access to critical data within Oracle Process Manufacturing Systems, allowing attackers to create, delete, or modify data without proper authorization. This compromises confidentiality and integrity of the affected systems. There is no reported impact on availability. No known exploits in the wild have been reported as of the advisory date.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends staying on actively supported versions and applying security updates without delay. Patch status is confirmed as available via the vendor advisory.