This vulnerability in Oracle Enterprise Asset Management allows a low‑privileged attacker who can reach the application over HTTP to fully compromise the system. A successful exploit results in control of the entire component, impacting confidentiality, integrity, and availability of the asset management data. The CVSS 3.1 base score of 8.8 reflects the severity of this takeover.

Oracle Corporation’s Oracle Enterprise Asset Management product, part of Oracle E‑Business Suite, is affected in versions 12.2.6 through 12.2.15. The vulnerability is specific to the Internal Operations component and is reachable via public or internal HTTP interfaces.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates that network access is sufficient, low effort is required, and no user interaction is necessary. The EPSS score is below 1%, suggesting the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker with local network presence could exploit the flaw and gain full administrative control. The potential impact on business continuity and data integrity is significant.