The vulnerability in the Security API of Oracle Sales Foundation allows a low‑privileged attacker with network access via HTTP to compromise the system. A successful exploitation can lead to full takeover of the application, resulting in loss of confidentiality, integrity, and availability. The weakness is characterized by an access vector that requires only network connectivity, high complexity of attack, low privilege and no user interaction, as reflected in the CVSS vector. The impact level is high across all three CIA triad categories.

Affects Oracle Sales Foundation from Oracle Corporation, versions 12.2.3 through 12.2.15. No other product versions were reported as impacted.

The CVSS base score of 7.5 indicates a high risk. EPSS data is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is over HTTP from a low‑privileged source, making the vulnerability remote and exploitable without user interaction. Although described as difficult to exploit, the high impact warrants serious attention.