The vulnerability exists in the Oracle Process Manufacturing Product Development component of Oracle E‑Business Suite, specifically within Quality Management Specs. A low‑privileged attacker who can reach the application over HTTP can exploit the flaw to compromise the system, resulting in complete takeover of the Oracle Process Manufacturing Product Development environment. The flaw causes full confidentiality, integrity, and availability loss, as indicated by a CVSS 3.1 Base Score of 8.8.

Affected products include Oracle Process Manufacturing Product Development as part of Oracle E‑Business Suite. Supported versions from 12.2.3 through 12.2.15 are impacted. The vulnerability is documented for the Quality Management Specs component of that product line.

The attack vector is network-based via HTTP, requiring only local privilege to execute. The EPSS score is less than 1%, indicating that, as of today, exploitation is low-probability, but the CVSS score shows high severity. The vulnerability is not currently listed in CISA KEV. Given the low privilege requirement and network availability, there is a real risk that an attacker could ultimately gain full system control if the flaw is present.