The Oracle Application Object Library (AOL) component of Oracle E-Business Suite is vulnerable to a local privilege escalation that allows a low‑privileged user who can log onto the underlying infrastructure to gain full control of the AOL database privileges subsystem. The flaw results in a complete compromise of the application with full confidentiality, integrity and availability loss, as reflected by the CVSS base score of 7.8.

The vulnerability affects Oracle Application Object Library versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, as listed by the vendor in the advisory.

The CVSS v3.1 base score of 7.8 indicates high severity, with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H showing that the attack is local, requires authenticated low‑privileged access, and does not need user interaction. The EPSS score of < 1 % suggests that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must possess a valid user account on the host system where AOL runs; once logged in, the attacker can exploit the flaw to take over the application.