A flaw in Oracle E‑Business Suite Assets Internal Operations permits a low‑privileged attacker with network access via HTTP to trigger a complete denial of service by repeatedly crashing the application. The same vulnerability also allows the attacker to read, update, or delete restricted data, resulting in confidentiality, integrity, and availability impacts as reflected by the 7.6 CVSS score.

Oracle Assets, part of the E‑Business Suite, versions 12.2.3 through 12.2.15 are susceptible to exploitation.

The CVSS base score of 7.6 indicates a high‑severity condition. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is network based over HTTP, requiring only low‑privileged access and no additional credentials. If an attacker can reach the exposed endpoint, the vulnerability can be exploited readily and repeated.