This vulnerability affects Oracle Bills of Material versions 12.2.13 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the product. The scope of impact may extend beyond Oracle Bills of Material to other Oracle products. Exploitation can result in unauthorized creation, deletion, or modification of critical data, with high confidentiality and integrity impacts. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update, which contains 673 security patches across multiple Oracle product families. Customers are urged to apply these patches without delay to mitigate the risk.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data within Oracle Bills of Material, potentially compromising confidentiality and integrity of all accessible data. The vulnerability's scope change means additional Oracle products may also be impacted. There is no impact on availability. The CVSS 3.1 score of 8.2 indicates a high severity threat.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the relevant patches for Oracle Bills of Material versions 12.2.13 through 12.2.15 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.