The vulnerability resides in the SOA Provider component of Oracle E‑Business Suite Integrated SOA Gateway. It permits a low‑privileged attacker who can reach the gateway over HTTP to compromise the entire gateway. Successful exploitation results in full takeover, with severe confidentiality, integrity and availability impacts as indicated by the CVSS vector. The nature of the flaw suggests an improper access control weakness that allows an attacker to bypass standard authorization checks.

Oracle E‑Business Suite Integrated SOA Gateway versions 12.2.3 through 12.2.15 are affected. The vulnerability applies to users running these releases in any environment where the gateway is reachable via HTTP.

The CVSS v3.1 base score of 7.5 classifies this as a high‑severity vulnerability. The EPSS score is not available, but the lack of a KEV listing indicates no known active exploitation. The likely attack vector is over the network via the HTTP interface, requiring only low privileges to initiate the attack. The impact is high because full gateway takeover is possible once the flaw is leveraged.