This vulnerability affects Oracle Work in Process versions 12.2.3 to 12.2.15. It requires an attacker to have access to the physical communication segment connected to the hardware where Oracle Work in Process executes. The flaw allows unauthorized attackers to compromise Oracle Work in Process, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the product. The CVSS vector indicates the attack vector is adjacent network (AV:A), with low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality and integrity impacts (C:H/I:H), but no impact on availability (A:N).

An attacker with physical network access can fully compromise Oracle Work in Process data integrity and confidentiality, including unauthorized creation, deletion, or modification of critical data. This can lead to significant data breaches and operational disruption within Oracle E-Business Suite environments using affected versions.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected Oracle Work in Process versions 12.2.3 through 12.2.15. Oracle emphasizes remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks. Patch status is confirmed by the vendor advisory and official patch documentation linked in the advisory.