The vulnerable component, AD Utilities in Oracle Applications DBA, allows an attacker with low‑privileged local logon to compromise the Applications DBA service. The attack requires human interaction from a user other than the attacker. If successful, the attacker can take full control of Applications DBA, leading to full confidentiality, integrity, and availability loss for the application data and services.

Oracle E-Business Suite version 12.2.3 through 12.2.15, specifically the Applications DBA product. This includes all installations of the AD Utilities component within that version range.

The CVSS 3.1 base score of 7.3 indicates a high‑severity vulnerability with severe impacts on confidentiality, integrity, and availability. The attack vector is local access (AV:L). Exploitation requires low effort and can be performed by an attacker who has low privileged access to the underlying infrastructure, with the help of another user. EPSS is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS score and requirement for only local logon mean that an organization with exposed infrastructure could be at significant risk if not addressed promptly.