A flaw in the Internal Operations component of Oracle Applications Manager enables a low‑privileged attacker with network access over HTTP to compromise the application. The vulnerability allows the attacker to take full control over the targeted instance, resulting in loss of confidentiality, integrity, and availability as the entire service can be altered or disabled at the attacker’s discretion.

Oracle Applications Manager, part of Oracle E‑Business Suite, across versions 12.2.3 through 12.2.15, distributed by Oracle Corporation. The scope change may affect additional related Oracle products that interact with the compromised component.

The CVSS 3.1 base score of 9.9 indicates a critical severity. The vector AV:N/AC:L/PR:L/UI:N/S:C shows that exploitation is possible over the network by users who require only low privileges and no user interaction. Although the EPSS score is below 1%, meaning the likelihood of exploitation is low, the potential impact warrants urgent attention. The vulnerability is not catalogued in CISA KEV catalog at this time.