A vulnerability in Oracle General Ledger allows a low‑privileged attacker with network access to the HTTP service to take over the application. The flaw operates through the internal operations component and can be triggered without user interaction, resulting in full compromise of confidentiality, integrity and availability. The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H demonstrates that once the flaw is leveraged, the attacker can directly control the ledger system.

Oracle General Ledger, as part of Oracle E‑Business Suite, is affected in released versions 12.2.3 through 12.2.15. The issue resides in the internal operations component of the product and any deployment of these Oracle General Ledger versions is potentially vulnerable.

The flaw carries a CVSS base score of 7.5, indicating a high severity vulnerability. EPSS score < 1% (≈ 0.00345) suggests a very low exploitation probability, but it is still non-zero and valid. The vulnerability is listed in Oracle's advisory and is not yet listed in CISA KEV catalog. The likely attack vector is network access via HTTP, requiring only a low‑privileged attacker to initiate the exploit. The difficulty of exploitation is described as high, yet the potential impact is complete takeover of the ledger system.