Oracle Order Management contains a Product Diagnostic Tools component that can be invoked over HTTP. The description indicates that a low‑privileged attacker with network access can exploit this functionality to read critical data or gain full access to all data exposed by Oracle Order Management. This suggests an improper access control flaw, inferred from the description that low‑privileged users can exploit the HTTP interface. The weakness can be classified as CWE‑284 (Improper Access Control) and CWE‑200 (Information Exposure). The immediate impact is a confidentiality breach of sensitive order information.

Affected systems are the Order Management component of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15. Vendors have released a CPU patch in October 2026 to address the issue. All installations running any of these versions should apply the patch if not already done.

The CVSS v3.1 Base Score of 6.5 indicates a moderate severity with a high confidentiality impact. No EPSS data is currently available, and the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation at the time of reporting. The attack vector is network‑based HTTP access, which means any external entity that can reach the Order Management service can attempt the exploit. The low privilege requirement further lowers the barrier to attack, increasing the overall risk. Based on the description that the vulnerability can be triggered via HTTP, it is inferred that the attack path involves making a specific HTTP request to a diagnostic endpoint.