Oracle Partner Management in Oracle E‑Business Suite contains a flaw in the Internal Operations component that permits a low‑privileged attacker with network access via HTTP to compromise the service. Exploitation can lead to unauthorized access to critical data or complete exposure of all data accessible through Partner Management. The CVSS v3.1 Base Score of 6.5 reflects significant confidentiality impact.

Affected are Oracle Partner Management versions 12.2.3 through 12.2.15, which are supported under Oracle E‑Business Suite. The specific component impacted is Internal Operations and the vulnerability can be triggered by any user that can reach the HTTP interface.

The moderate CVSS score indicates a meaningful threat to confidentiality, yet the risk remains uncertain because the EPSS score is unavailable and the issue is not listed in the CISA KEV catalog. The likely attack vector is a remote exploit over HTTP by an attacker with low privileges, suggesting that an improperly validated request handler or missing access control is at fault. Should the vulnerability be actively exploited, an attacker could read or modify Partner Management data without elevated privileges.