A vulnerability in Oracle Applications DBA Java utilities allows an attacker who possesses high privileges and can reach the service over HTTP to exploit the system. The flaw enables creation, deletion or modification of data and can grant complete data access to the attacker, compromising confidentiality and integrity of all Oracle Applications DBA data. The CPE indicates that this issue resides in the database administration component of Oracle E‑Business Suite, exposed to network traffic.

Oracle Corporation’s Oracle Applications DBA product, part of Oracle E‑Business Suite. Affected releases span version 12.2.3 through 12.2.15. The core Ken they'd be impacted are those deployed with the Java utilities component in these releases. Precise build or patch identification is not provided beyond the version range.

The CVSS score of 6.5 reveals a moderate severity impact, yet an EPSS score of less than 1% suggests low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, further indicating limited real‑world exploitation. Attackers would likely initiate the exploit via HTTP from the network, requiring high privileges on the system. Without the vulnerability, no unauthorized data tampering or access could occur, but once exploited, the attacker can freely alter or view all data available to the Oracle Applications DBA.