This vulnerability in Oracle Capacity's Internal Operations component allows an attacker with local network access and limited privileges to manipulate the HTTP interface. By sending crafted requests, the attacker can read sensitive data, modify or delete records, and induce a partial denial of service. The weakness exploits improper access control, enabling unauthorized access to confidential information and affecting confidentiality, integrity, and availability.

The Oracle Capacity product of Oracle E‑Business Suite, specifically versions 12.2.3 through 12.2.15, is affected. If your organization runs any of these releases on network‑exposed servers, the system is at risk.

The CVSS v3.1 base score of 7.6 signifies high risk. The vulnerability is exploitable over network via HTTP by a low‑privilege user, with an attacker able to gain read, modify, or delete operations on capacity data and disrupt service partially. EPSS is not available and it is not listed in CISA KEV, but the simplicity of the attack path makes it a credible threat to exposed installations.