The vulnerability in Oracle Subledger Accounting allows a low‑privileged network attacker with HTTP access to fully compromise the application, resulting in loss of confidentiality, integrity, and availability. The weakness manifests as an improper access control flaw that permits unauthorized users to perform privileged operations, effectively bypassing the intended security controls.

Oracle Corporation’s Oracle Subledger Accounting component of Oracle E‑Business Suite is vulnerable in versions 12.2.3 through 12.2.15. The issue is limited to the Internal Operations component exposed over HTTP.

The CVSS base score of 7.5 indicates a moderate‑to‑high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves a network‑level attacker sending crafted HTTP requests with minimal privileges, exploiting the access‑control weakness to achieve full takeover.