An access‑control flaw exists in Oracle Report Manager that permits a low‑privileged attacker with network reach via HTTPS to gain unauthorized read, write, and delete privileges over all data exposed through the management interface. The vulnerability also enables the attacker to trigger a partial denial of service, disrupting the availability of Oracle Report Manager for legitimate users. This flaw leads to confidentiality, integrity, and availability impacts as described in the CVSS vector.

Oracle Report Manager within Oracle E‑Business Suite, versions 12.2.3 through 12.2.15.

The CVSS v3.1 base score of 7.6 indicates high severity. Because the attack requires only low privileges but is carried out over a network via HTTPS, the threat is realistic for any organization that exposes Report Manager to external or internal attackers. The EPSS score is not available and the vulnerability has not yet been cataloged in the CISA KEV list, but the combination of a high CVSS score, accessible exploit vector, and the ability to execute remote unauthorized operations presents a significant risk. An attacker could compromise sensitive reporting data or disrupt reporting services.