An unauthenticated attacker with network access can send HTTP requests to the Oracle E-Business Suite Integrated SOA Gateway, enabling unauthorized read, update, insert, or delete operations on the data accessible through the SOA Provider component. The vulnerability results in a high confidentiality impact and a low integrity impact, and the CVSS v3.1 base score of 8.2 reflects the ease of exploitation and the potential for significant data compromise.

Oracle Corporation’s Oracle E-Business Suite Integrated SOA Gateway is affected for all supported releases from 12.2.3 through 12.2.15. These versions include the SOA Provider component which processes the vulnerable HTTP traffic.

The CVSS score of 8.2 indicates a high severity incident, and the absence of a listed EPSS score or KEV entry does not diminish the risk of exploitation, as the vulnerability is readily exploitable without authentication or user interaction. An attacker can send crafted requests over HTTP to the target gateway and achieve full data access and modification, implying a substantial confidentiality breach with potential business impact.