An unauthenticated attacker with network access through HTTP can fully compromise the Oracle Application Object Library, leading to complete takeover of confidentiality, integrity, and availability. The vulnerability effectively allows an attacker to execute arbitrary code or commands on the affected system, matching the characteristics of a remote code execution or authentication bypass flaw. The impact is that any user or process relying on the library would be exposed to compromise.

Oracle Corporation’s Oracle Application Object Library, a core component of Oracle E‑Business Suite, is affected. Versions 12.2.3 through 12.2.15 are listed as vulnerable. The issue applies to the Core part of the product, meaning compromise of this library can disrupt the entire application stack that depends on it.

The CVSS 3.1 Base Score of 9.8 signals a critical risk. The vector shows that the flaw is exploitable over the network with low complexity, no privileges, no user interaction, and no scope change. Attackers can reach the vulnerable component via HTTP without prior authentication, making the vulnerability readily exploitable by anyone on the network. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation, yet the high CVSS score and unrestricted network access imply that a determined attacker could still successfully exploit the flaw. The vulnerability is not yet listed in CISA’s KEV catalog, but the critical severity demands urgent action.