An access control flaw in the Documents component of Oracle One-to-One Fulfillment enables a low‑privileged attacker who can reach the system over HTTP to compromise the application and acquire full control. The vulnerability results in complete loss of confidentiality, integrity, and availability for the affected instance, as the attacker can modify or delete any transaction data and potentially extend control to other parts of the E‑Business Suite. The issue is rated CVSS 3.1 Base 7.5 with high impact on all three CIA properties.

Oracle One-to-One Fulfillment (Oracle E‑Business Suite) versions 12.2.3 through 12.2.15 are affected. The flaw resides in the Documents module of this product and all installations of these versions possess the same vulnerability unless patched.

The CVSS score of 7.5 classifies the risk as high; the EPSS score is not available, and the lack of a KEV listing does not reduce the likelihood of exploitation based on the documented CVSS severity. A network attacker with simple HTTP access and low privilege can exploit the flaw, so the primary attack vector is remote network access via standard web traffic. The exploit requires no special software beyond a standard HTTP client, and success would result in full takeover of the application. Organizations should treat this as a high‑priority risk.