A vulnerability in the Award/PO component of Oracle Contract Lifecycle Management for Public Sector allows an attacker with high‑privileged access and network connectivity to the HTTP interface to compromise the entire application. The flaw can be exploited over the network and can result in complete takeovers, affecting confidentiality, integrity, and availability of contract management data.

The affected product is Oracle Contract Lifecycle Management for Public Sector, part of Oracle E‑Business Suite, specifically the Award/PO component. Versions 12.2.3 through 12.2.15 are vulnerable.

The CVSS 3.1 base score of 7.2 indicates a moderate‑to‑high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑reachable HTTP request; the attacker must possess high‑privilege credentials to exploit the flaw. Exploitation would allow privileged attackers to compromise confidentiality, integrity, and availability of the entire system.