Oracle E‑Business Suite’s Applications DBA component contains an easily exploitable flaw that allows an unauthenticated attacker who can log on to the same infrastructure to gain full control of the Applications DBA process, resulting in confidentiality, integrity and availability loss. The weakness appears to be an improper privilege handling or authorization bug that permits an attacker to take over the DBA service; the description suggests the attacker may need another person to interact with the service and trigger the flaw, although once triggered it grants complete control. This vulnerability can lead to an application takeover, allowing the attacker to execute arbitrary actions on the database and environment. The impact is categorized as a High severity flaw with significant risk to mission‑critical data.

The affected product is Oracle Corporation’s Applications DBA, part of Oracle E‑Business Suite. Supported versions ranging from 12.2.3 through 12.2.15 are affected. No other vendors or products are listed, and the CPE string confirms the scope is limited to Oracle Applications DBA.

The CVSS 3.1 base score is 7.8, indicating a High severity. EPSS < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local (AV:L) with low attack complexity (AC:L) and does not require an authenticated user on the infrastructure. The exploit demands user interaction from a non‑attacker, implying that local privileged or logged‑in users may need to execute or confirm an action; once the vulnerability is triggered, the attacker can take over the Applications DBA service, compromising confidentiality, integrity and availability.