The vulnerability in Oracle Product Workbench allows an unauthenticated network attacker to perform arbitrary data creation, deletion, or modification, and to access all data exposed by the product. It was identified in the WebUI component of Oracle E‑Business Suite versions 12.2.3 through 12.2.15. The vulnerability is exploitable over HTTP without any authentication and provides the attacker with full read and write privileges to all accessible data.

Affected systems include Oracle Corporation’s Oracle Product Workbench, a component of Oracle E‑Business Suite. Supported versions 12.2.3 to 12.2.15 are impacted. No sub‑version or patch information is provided. Administrators should verify the exact build of their installation and ensure it falls within that range.

This vulnerability is scored 9.1 on CVSS 3.1, indicating a high‑severity flaw with complete confidentiality and integrity compromise, while availability remains unaffected. Because the attack requires only network connectivity to the WebUI and no authentication, it is trivially exploitable for any host exposed to the internet or internal network. The EPSS score of 0.00427 and exclusion from CISA’s KEV catalog do not reduce the urgency, as the inherent exposure and ease of exploitation make it a priority for remediation.