This vulnerability affects Oracle Product Workbench within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits a low privileged attacker with network access over HTTP to compromise the product by leveraging user interaction from a third party. The scope of impact extends beyond Oracle Product Workbench to other Oracle products. Exploitation can lead to unauthorized read access to some data and unauthorized update, insert, or delete access to other data within Oracle Product Workbench. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, user interaction required, scope change, and low confidentiality and integrity impacts.

Successful exploitation allows unauthorized modification (update, insert, delete) and limited unauthorized reading of data within Oracle Product Workbench. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires user interaction from a person other than the attacker, and the scope of the vulnerability extends to additional Oracle products beyond Product Workbench.

Oracle has released security patches addressing this vulnerability as part of their September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory, which provides patch availability information. No indication of 'no action required' or 'already mitigated' was provided, so patching is the recommended mitigation.