A vulnerability exists in Oracle Spares Management’s Internal Operations component that permits a low‑privileged attacker with HTTPS network access to compromise the system. Successful exploitation allows the attacker to fully take over Oracle Spares Management, resulting in complete loss of confidentiality, integrity, and availability for that component. The weakness aligns with improper authentication or input validation, enabling unauthorized control over the management platform. The CVSS 3.1 base score of 8.8 denotes a high severity threat with direct system compromise.

Oracle Corporation’s Oracle Spares Management, part of Oracle E‑Business Suite. Versions 12.2.3 through 12.2.15 are affected; newer releases are not impacted.

The CVSS score indicates a high‑severity vulnerability with low authentication requirements (PR:L) and network‑accessible HTTPS entry. The EPSS score is below 1 %, suggesting a low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the easily exploitable nature of the flaw allows a hostile actor to gain full control of the system, potentially enabling lateral movement or data exfiltration.