Easily exploitable vulnerability in Oracle Partner Management allows a low‑privileged attacker with network access via HTTP to create, delete or modify critical data and to cause a partial denial of service. The flaw is an authorization weakness that lets the attacker bypass normal access controls and tamper with internal operational data, potentially compromising the integrity of the system and the availability of its services.

Oracle Corporation’s Oracle Partner Management component of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, is affected. The weakness resides in the Internal Operations module and can be triggered by any HTTP request sent to the application.

The CVSS v3.1 base score is 7.1, reflecting significant integrity and availability impacts, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based via the exposed HTTP interface, requiring only low privileges. Because the error is exploitable without local code execution or elevated privileges, the risk to organizations is high for those that expose the application to the public network or shared internal environments.