This vulnerability stems from a flaw in the Security component of Oracle Flow Manufacturing that permits a low‑privileged user with network access to manipulate SQL commands. The vulnerability can lead to complete compromise of the application, exposing confidential data and allowing modification or disruption of business processes. The primary weakness is an improper privilege management flaw (CWE‑269).

Oracle Flow Manufacturing, part of Oracle E‑Business Suite, is affected in versions 12.2.9 through 12.2.15. Users of these releases should confirm that their instances fall within this version range.

The CVSS v3.1 base score of 8.8 indicates a high‑severity risk. The attack vector AV:N shows the flaw is reachable over the network, AC:L indicates minimal effort is required, and PR:L confirms low‑privilege credentials suffice. The EPSS score of less than 1% suggests a very low probability of exploitation at present, but the vulnerability remains exploitable under the described conditions. The flaw is not yet listed in the CISA KEV catalog, so a targeted attack is not publicly known at this time. The likely attack path involves a network‑bound attacker sending crafted SQL through the application, leading to privilege escalation and full takeover.