The vulnerability is an improper access control flaw in the Internal Operations component of Oracle Production Scheduling. A low‑privileged attacker who has logged on locally to the infrastructure can perform unauthorized insert, update, or delete operations on scheduling data, read restricted information, and trigger a partial denial of service. The CVSS 3.1 base score of 4.5 indicates low confidentiality, integrity, and availability impact.

Oracle Corporation’s Production Scheduling product, part of the E‑Business Suite, is affected for versions 12.2.3 through 12.2.15 in the Internal Operations component. The flaw requires local access to the host where Production Scheduling runs.

The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U shows that the attack requires local access and low privilege, and no user interaction, while impacting only the system owning the application. The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation. The most likely attacker is a low‑privileged user who has already logged into the production environment and exploits missing authorization checks to manipulate data or disrupt service.