This vulnerability enables an attacker to use HTTP network access to obtain unauthenticated control over Oracle Concurrent Processing, allowing creation, deletion, or modification of critical data. The CVSS vector indicates that the attack requires no authentication and no user interaction, with a high complexity level, resulting in confidentiality and integrity impact but no availability impact.

Oracle Concurrent Processing within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is affected. Only these product versions are vulnerable according to Oracle’s advisory.

With a CVSS score of 7.4, the severity is considered high. Although an EPSS score is not available, the absence of authentication pre-requisites and the reliance solely on network access over HTTP make exploitation realistically feasible for adversaries that can reach the service. The vulnerability is not listed in the CISA KEV catalog, but its potential to compromise entire data sets warrants prompt attention.