The vulnerability in Oracle Sales Online allows a low‑privileged attacker with network access via HTTP to obtain unauthorized control over the application. Successful exploitation enables the attacker to create, delete, or modify critical data and to read subsets of data that should remain confidential. The impact is primarily on data integrity and, to a lesser extent, confidentiality, with no direct effect on availability. The weakness stems from improper access control mechanisms, as the application does not enforce sufficient privilege checks for these operations.

Oracle Corporation’s Sales Online component of Oracle E‑Business Suite, specifically supported versions 12.2.3 through 12.2.15, is affected. Users of these Oracle Sales Online releases must verify that they are running these versions; any other version is not confirmed to be impacted.

The CVSS v3.1 base score of 7.1 indicates a high severity for remote attackers. The vulnerability is easily exploitable (attack vector: network via HTTP) and can be performed with low privileges (e.g., a minimally authorized user). The EPSS score is not available, but the lack of a KEV listing does not diminish the risk posed to organizations still running the affected software. Attackers with network access can exploit this weakness to conduct both integrity‑changing and read‑only data operations, potentially compromising business processes and data confidentiality.