Oracle iAssets, a component of Oracle E‑Business Suite, has a vulnerability that allows a low‑privileged attacker, who can reach the system over HTTP, to take full control of the application. The flaw can be exploited with minimal effort and without user interaction, leading to the disclosure of confidential data, modification of system state, and loss of availability. The high impact on confidentiality, integrity, and availability is reflected in the CVSS 3.1 base score of 9.9.

Versions of Oracle iAssets from 12.2.3 through 12.2.15 are affected. The vulnerability is present in the Internal Operations component of the platform and may affect other Oracle E‑Business Suite products due to scope change. Users running these releases should verify their installation against the advisory.

The issue can be exploited remotely via the public network, requiring only a network connection to an HTTP endpoint. Because the required privilege level is low and no special inputs are needed, the attack vector is simple and the likelihood of exploitation is high, as the CVSS score indicates. Although the EPSS score is not available, the severity and lack of defensive controls make this vulnerability a high‑risk target. It is not yet listed in the CISA KEV catalog, but the impact warrants immediate attention.