Oracle Enterprise Asset Management in Oracle E‑Business Suite has an internal operations flaw that a low‑privileged attacker can exploit over HTTP. The vulnerability allows bypassing normal authentication controls, enabling the attacker to read critical data or all data exposed by the service. Additionally, the flaw can be used to trigger a partial denial of service. The CVSS 3.1 vector reflects a network‑based attack that requires low privilege and no user interaction, resulting in high confidentiality impact and low availability impact.

Affected systems include Oracle Corporation’s Oracle Enterprise Asset Management component of Oracle E‑Business Suite, with supported versions from 12.2.3 through 12.2.15. These versions are widely deployed in enterprise environments and remain publicly available, placing organizations that have not applied a fix at significant risk.

The CVSS base score of 7.1 signals a moderate‑to‑high severity, while the EPSS score of less than 1% indicates that the chance of exploitation is currently low. The flaw is not listed in the CISA KEV catalog. Nonetheless, the attack path is straightforward: a low‑privileged user with network access on the HTTP interface can trigger the flaw. Because the flaw can expose sensitive asset data and disrupt availability, organizations should treat it as a moderate–high risk that requires prompt remediation.