A vulnerability exists in the AD Utilities component of Oracle Applications DBA that allows a low‑privileged user who can log on to the host to compromise the Applications DBA service. The impact is takeover of the service, resulting in full data confidentiality, integrity, and availability loss for database administration functions. The problem is classified as a local privilege escalation with a CVSS 3.1 base score of 7.0, indicating moderate‑to‑high severity for a low‑privileged local attacker.

Oracle Corporation: Applications DBA, versions 12.2.3 through 12.2.15, are affected. Any installation within this range that runs on infrastructure where a low‑privileged account can log on is vulnerable.

The CVSS score of 7.0 signifies a moderate‑to‑high risk level for a local attacker. The EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; it requires the attacker to have an existing local account on the host where Applications DBA is running. Exploitation is described as difficult, meaning that configuration or other prerequisites may be needed. Successful exploitation would give full control over the local Applications DBA process and the associated database management capabilities, but the impact is limited to the host where the service runs and does not provide a remote vector as stated in the description.