The vulnerability resides in the Oracle E-Business Suite Integrated SOA Gateway and allows an unauthenticated attacker who can reach the system over HTTP to gain unauthorized access to data stored within the gateway. The flaw is easily exploitable, with a CVSS 3.1 base score of 8.6 and a vector indicating network access, low attack complexity, no privileges required, no user interaction, and a confidentiality impact. The reported scope change suggests that successful exploitation could also affect other Oracle E-Business Suite components beyond the gateway itself.

Affected are Oracle E-Business Suite Integrated SOA Gateway versions 12.2.3 through 12.2.15. The product is part of Oracle E‑Business Suite and is distributed by Oracle Corporation.

The high CVSS score reflects significant risk, though no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The lack of a public exploitation score does not diminish the likelihood that attackers will target this remote, unauthenticated path. Because the flaw grants access to critical data, the overall impact can be severe, potentially allowing attackers to read sensitive business information or to undermine data integrity by accessing other integrated services.