This vulnerability, present in Oracle Bills of Material versions 12.2.3 through 12.2.15, enables a low‑privileged network attacker to compromise the application via an HTTP interface. Successful exploitation can result in a full takeover, affecting confidentiality, integrity and availability. The weakness appears to stem from inadequate authentication or authorization controls, allowing privileged access to be gained from non‑privileged users.

Oracle Bills of Material, part of Oracle E‑Business Suite internal operations, is affected in versions 12.2.3 to 12.2.15.

The CVSS score of 7.5 signals moderate‑to‑high severity, with a high attack complexity and low privilege requirements. Although EPSS is not available and the vulnerability is not listed in CISA KEV, the attack vector would be over HTTP; a successful exploit would grant attackers total control over Bills of Material and could jeopardize entire enterprise processes.