Oracle Email Center is vulnerable to an exploit that permits a low‑privileged attacker with network connectivity to HTTP to access or fully control the system’s data. The official advisories describe the flaw as an “easily exploitable” condition that can result in unauthorized access to critical data. The nature of the weakness is not explicitly identified in the CVE text, but the impact category (confidentiality) and the CVSS vector suggest it involves improper access control or authorization bypass, corresponding to CWE‑284. Information about the precise code flaw is not disclosed in the description.

Oracle Corporation’s Oracle Email Center, a component of the Oracle E‑Business Suite, is affected. Supported versions 12.2.3 through 12.2.15 are listed as vulnerable. Users of these versions should verify whether their installations match one of those ranges and check the Oracle June 2026 CPU advisory for the specific release notes and patch details.

The CVSS v3.1 base score of 6.5 indicates moderate severity with a significant confidentiality impact. Because EPSS data are unavailable, the current probability of exploitation cannot be quantified. The vulnerability is not part of the CISA KEV catalog, suggesting no known widespread exploitation at this time. Based on the description, the likely attack vector is transmission of crafted HTTP requests from a remote host. Successful exploitation would require only local network connectivity to the Email Center’s HTTP port and does not necessitate elevated privileges on the target system.