A low‑privileged attacker who can reach Oracle Capacity over the network via HTTP can gain unauthorized access to all data accessible to the application. The vulnerability is described as an easily exploitable flaw in the Internal Operations component, leading to both improper access control and information exposure. This results in a high confidentiality impact. The CVSS 3.1 base score of 7.7 indicates a moderate‑to‑high severity, with the weaknesses classified as Improper Access Control (CWE‑284) and Information Exposure (CWE‑200).

The flaw exists in Oracle Capacity, a component of Oracle E‑Business Suite, and affects all supported versions from 12.2.3 through 12.2.15. If breached, the impact may extend beyond Capacity to other products within the suite because the flaw can change scope.

The vulnerability is remotely exploitable from an external network with simple network access to the HTTP service. The EPSS score is < 1%, indicating a low but nonzero probability of exploitation. The lack of a known public exploitation does not reduce the risk posed by a potential attacker with low privileges. The CVSS score of 7.7 coupled with the broad scope change suggests a significant threat to confidentiality, and the fact that it is not listed in the CISA KEV catalog indicates that official exploitation is not yet documented, but security teams should treat it as a high‑priority risk.