A vulnerability in Oracle Inventory Management allows a low‑privileged attacker who has logged on to the infrastructure where the product runs to compromise the application. Successful exploitation results in full takeover, affecting confidentiality, integrity, and availability. The CVSS 3.1 base score of 7.0 reflects local attack, high complexity, and low privilege requirements but severe consequences.

The vulnerability affects Oracle Inventory Management versions 12.2.3 through 12.2.15 inclusive. Any deployment of these releases within Oracle E‑Business Suite is at risk.

With a CVSS score of 7.0 and no publicly available EPSS data, the vulnerability is considered high risk but its likelihood of exploitation depends on the attacker’s ability to log on locally. As it is not listed in the CISA KEV catalog, there is no known mass exploitation, yet the potential damage warrants immediate attention. The attack vector is inferred to be local; an attacker must have some form of access to the underlying infrastructure to exploit it.