The vulnerability resides in the Oracle HCM Common Architecture component of Oracle E-Business Suite (Internal Operations). An attacker with a low privileged account who can access the application via HTTP may exploit a flaw that leads to unauthorized takeover of the entire Oracle HCM Common Architecture. The potential impact includes loss of confidentiality, integrity, and availability of the system’s data and functions, effectively granting complete control over the application environment. This weakness aligns with improper access control and privilege management (CWE-284, CWE-269).

Affected is Oracle Corporation’s Oracle HCM Common Architecture for Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. The vulnerability is listed under the Internal Operations component of the product.

The CVSS base score is 7.5, indicating high severity with full impact on confidentiality, integrity and availability. The EPSS score is not available, making it uncertain how frequently this flaw is currently exploited. The flaw is not yet in the CISA KEV catalog. The likely attack vector is a network-facing HTTP interface accessed by a low privileged user; the attacker must first craft a request that exploits the flaw, then leverage the resulting compromise to take full control of the application. Because the exploit is characterized as “difficult to exploit,” the likelihood of success in the wild is lower, but the potential damage remains severe if the exploit works.