The Oracle General Ledger product has a vulnerability that allows a low-pri­vileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a full takeover, affecting confidentiality, integrity, and availability. The CVSS vector indicates a network attacker, high effort, low privilege, no user interaction, and an unmodified scope. The impact is a complete compromise of the General Ledger instance.

This issue affects Oracle E‑Business Suite General Ledger versions 12.2.3 through 12.2.15. The product component implicated is ADADMIN. The reference for this advisory can be found at Oracle's security alerts page. No other vendors or versions are listed.

The CVSS base score of 7.5 indicates a high severity. EPSS is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog. The attack requires network connectivity to a General Ledger HTTP interface and an account with low privileges; a successful exploit can be achieved without user interaction, making it a realistic threat for an attacker with access to the internal network. Because the vulnerability allows a full system takeover, organizations should treat it as a high priority risk.