A vulnerability in Oracle Capacity allows an attacker who has only low privileges and network access to the HTTP interface to compromise the application. The weakness can be exploited from a remote host, enabling the attacker to obtain unauthorized access to critical data stored or managed by Oracle Capacity. The impact is a breach of confidentiality without affecting integrity or availability, as the CVSS vector shows a high confidentiality impact and no effect on integrity or availability.

Affected versions of Oracle Capacity within Oracle E‑Business Suite range from 12.2.3 through 12.2.15. The product is part of the Internal Operations component. No other vendors or product lineages are listed as affected.

The CVSS score of 7.7 reflects the severity of the confidentiality impact. With an EPSS score of <1%, the exploitation probability is very low but not zero, and the KEV status indicates no known active exploitation recorded. However, due to the remote nature and low privilege requirement, an attacker with network access could attempt this attack readily.