Vulnerability in the Internal Operations component of Oracle General Ledger allows a low‑privileged attacker who can access the system over HTTP to create, delete, or modify critical data, gain full data access, or cause a partial denial of service. The flaw is an access control weakness that permits unauthorized operations, leading to confidentiality, integrity, and availability impacts as reflected in the CVSS vector. Successful exploitation means the attacker can tamper with ledger entries, obscure audit trails, or disrupt processing for affected users.

All installations of Oracle Corporation’s Oracle General Ledger Product, versions 12.2.3 through 12.2.15, are affected. The vulnerability resides in the Internal Operations component and is reachable via HTTP. Oracle E‑Business Suite deployments that include these versions should be reviewed for this flaw.

The CVSS Base Score of 7.1 indicates high severity with a Network attack vector, High attack complexity, Low Privileges, no User Interaction, and a Unchanged scope. Although the EPSS score is not available, the score and vector suggest that exploitation is technically feasible with minimal effort from a network‑level attacker. As of now the vulnerability is not listed in CISA’s KEV catalog, implying no confirmed field‑used exploits, but the lack of protection mechanisms and the high impact warrant prompt attention.