Oracle E-Business Suite Integrated SOA Gateway is vulnerable due to an interaction within its SOA Provider component that allows an attacker with low privileges and network access via HTTP to gain complete control of the gateway service. Successful exploitation results in full compromise, providing the attacker the ability to read, modify, and delete application data and commands, thus affecting confidentiality, integrity, and availability. This threat level is characterized by a CVSS v3.1 score of 8.8, indicating high severity.

Affected are Oracle E-Business Suite Integrated SOA Gateway version 12.2.3 through 12.2.15, inclusive. Owners of these installations should verify their currently running version against this range to determine exposure.

The CVSS base score of 8.8, combined with a low attack complexity, low privileges requirement, and no user interaction, indicates that the vulnerability is highly exploitable over a network. Although an EPSS score is not available and the vulnerability is not yet listed in CISA KEV, the likelihood of exploitation remains high given the remote nature of the attack. An attacker only needs to send an HTTP request to a vulnerable endpoint to achieve takeover.