Vulnerability in Oracle Marketing’s Audience component permits an unauthenticated attacker with network access via HTTP to gain unauthorized access to the application. The flaw allows the attacker to read sensitive information across the system and to perform update, insert, or delete actions on data that should be protected. This results in confidentiality compromise for high‑impact data and potential integrity violations for lower‑impact data sets.

The affected product is Oracle Corporation’s Oracle Marketing, part of the Oracle E‑Business Suite. The specific component is Audience. Supported versions from 12.2.3 through 12.2.15 are affected. All installations of these versions deployed over HTTP remain vulnerable if the default unsecured endpoints are reachable.

Given the CVSS 8.2 rating, this vulnerability is classified as high severity. The EPSS score is currently unavailable, but the flaw is listed as not in the CISA KEV catalog, indicating no publicly known exploit at the time of this assessment. Because the attack requires only network access to HTTP and no authentication, exploitation is considered easy. An attacker who can reach the vulnerable endpoint can immediately read or modify critical data, making the risk of unauthorized access significant for any organization running the affected Oracle Marketing releases.