The vulnerability resides in the Product Diagnostic Tools component of Oracle Order Management within Oracle E‑Business Suite. It permits a low‑privileged attacker who can reach the system over HTTP to obtain unauthorized access to critical data, potentially even all data that the application can reach. This is an authorization bypass flaw that compromises confidentiality of the application’s data.

Affected are Oracle Order Management versions 12.2.3 through 12.2.15. The product part affected is the Product Diagnostic Tools feature in Oracle E‑Business Suite. Systems running these versions without the vendor’s resolution are susceptible.

The CVSS base score of 6.5 denotes medium severity with a high confidentiality impact. The EPSS score of < 1% indicates the current likelihood of exploitation is very low, and the vulnerability is not listed in CISA’s KEV catalog. Attack vectors involve sending a simple HTTP request to the Product Diagnostic Tools endpoint; no user interaction or elevated privileges are required beyond low access to the network. While the vulnerability is described as easily exploitable, real‑world usage appears limited, suggesting that the risk of exploitation remains modest.