This vulnerability allows a low‑privileged attacker with network access over HTTP to fully compromise the Oracle Quality component of Oracle E‑Business Suite. Successful exploitation results in a complete takeover, affecting confidentiality, integrity, and availability of the application. The CVSS 3.1 base score of 8.8 reflects high impact across all data types.

The affected product is Oracle Quality, part of Oracle E‑Business Suite, specifically the Internal Operations component. Vulnerable versions range from 12.2.3 through 12.2.15, all of which are currently supported. No other versions or products are listed as affected in the official advisory.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack can be performed remotely over network using simple credentials and does not require user interaction. Although the EPSS score is less than 1 %, suggesting a low probability of exploitation in the wild, the high severity and potential for system takeover mean that the risk remains significant. The vulnerability is not part of the CISA KEV catalog, but because of its remote nature and high impact it should be treated with urgency.