The vulnerability in the Oracle Global Lifecycle Management OPatchAuto product enables a high‑privileged local user to compromise the OPatchAuto process. Because the flaw is locally exploitable, it drives confidentiality, integrity, and availability impacts as noted by the CVSS 3.1 Base Score of 6.5. Successful attacks require that a non‑attacker user provide explicit interaction, meaning the attacker must co‑operate to trigger the exploit.

Affected systems include the OPatchAuto component delivered with Oracle’s Database extensions. The advisory lists versions 12.2.0.1.16 through 12.2.0.1.52 as susceptible to exploitation.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1% shows a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector is local and requires high‑level privileges along with a separate user’s interaction, only insiders or compromised high‑privilege accounts present a realistic threat scenario.