The flaw in Oracle Subledger Accounting allows a low‑privileged attacker with network access to send crafted HTTP requests that result in a full compromise of the application, giving the attacker complete confidentiality, integrity and availability control. The vulnerability is rated CVSS 7.5 with a vector of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation requires only network connectivity, does not need user interaction, and poses a high impact on all information system security objectives.

Oracle Subledger Accounting component of Oracle E‑Business Suite version 12.2.3 through 12.2.15 is affected. These versions are deployed in organizations using the Internal Operations module.

The EPSS score of less than 1% suggests that exploit attempts are currently rare, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the required effort is high but the potential consequence is a complete takeover, making the risk significant. Exploitation is believed to occur via the HTTP interface, with a low‑privilege attacker sending malicious requests to the internal operations API. No mitigation is indicated in the advisories beyond applying the vendor fix.