Easily exploitable flaw in Oracle Capacity's Internal Operations component allows a network adversary with low privileges to compromise the service, potentially leading to full takeover of the application. The vulnerability grants an attacker confidentiality, integrity, and availability damage, as indicated by a CVSS 3.1 Base Score of 8.8. The description does not detail an exact exploit mechanism, but the impact allows the adversary to assume operational control and access sensitive data managed by Oracle Capacity.

Oracle Capacity, part of Oracle E-Business Suite, versions 12.2.3 through 12.2.15 are affected. No further vendor or product details are provided beyond the Oracle Capacity component.

The CVSS vector shows that the attack can occur over network using HTTP, requires low privileges and no user interaction. Because the EPSS score is not available, the current recorded exploitation probability is unknown, but the high CVSS indicates that if exploited the consequences are severe. The vulnerability is not listed in the CISA KEV catalog, nevertheless its impact warrants urgent attention. The likely path involves sending crafted requests to the Internal Operations interface, exploiting improper access control or authentication weaknesses to gain full administrative rights.